The Linux kernel includes a function that was deliberately mislabeled as a non‑cached user copy routine. In reality it performs a non‑temporal store into the destination while handling exceptions for both source and destination accesses. Because the function does not enforce proper user‑space access control and may be called by drivers without preceding the necessary "start user space" checks, it can be misused to perform kernel‑space memory copies originating from untrusted user data. This misuse removes critical bounds checks and exception handling, creating a path for arbitrary kernel memory writes or silent crashes when the source or destination triggers a page fault or machine‑check exception. The result is potential kernel corruption, panic, or denial of service. Affected systems All Linux kernel builds that contain the __copy_user_nocache function are potentially impacted. The vulnerability exists before any official patch is applied, and the specific kernel versions are not listed in the data. Linux kernel users on any distribution should treat all kernels that have not applied the rename and protection changes as vulnerable. Risk and exploitability The issue does not appear to be remotely exploitable from user space alone; it requires a driver or privileged process that calls the misnamed routine. The CVSS score is not provided, and EPSS data is unavailable, indicating limited evidence of active exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation as of the current data. Nonetheless, any code path that calls this function without proper user‑access validation gives privileged code a direct avenue to corrupt kernel memory, making this a high‑severity local privilege escalation or abort scenario.

All Linux kernel builds that contain the __copy_user_nocache function are potentially impacted. The vulnerability exists before any official patch is applied, and the specific kernel versions are not listed in the data. Linux kernel users on any distribution should treat all kernels that have not applied the rename and protection changes as vulnerable.

The issue does not appear to be remotely exploitable from user space alone; it requires a driver or privileged process that calls the misnamed routine. The CVSS score is not provided, and EPSS data is unavailable, indicating limited evidence of active exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation as of the current data. Nonetheless, any code path that calls this function without proper user‑access validation gives privileged code a direct avenue to corrupt kernel memory, making this a high‑severity local privilege escalation or abort scenario.