The Linux kernel Data Lock Manager module accepts a length value sent in network–originated messages without validating it against the defined maximum. When the length surpasses DLM_RESNAME_MAXLEN, the kernel performs an out‑of‑bounds write while searching the RSB tree, which creates a classic buffer overflow that can corrupt kernel memory. Depending on how the kernel code is structured, this memory corruption could allow an attacker to execute arbitrary code with kernel privileges.

All Linux kernel variants that retain the unpatched DLM implementation are affected. This includes any distribution that ships the default kernel and has not applied the commit introducing length validation. Exact kernel versions are not enumerated, so any kernel built from source containing the vulnerable code before the patch is susceptible.

Because the vulnerability is remote‑accessible through the DLM network service, an attacker can send a crafted packet containing an oversized length value to trigger the overflow. The CVSS score is 7.0, and EPSS data is unavailable, indicating a high exploitation severity. The vulnerability is not listed in the CISA KEV catalog.