The vulnerability affects the Linux kernel’s io_uring buffer management. A gap occurs between the time a buffer is grabbed and when it is recycled; if a legacy buffer list has been replaced or is empty, the kernel could upgrade the list to a ring‑provided type without verifying its existence or type. This missing validation could allow an attacker to introduce a malformed or unexpected buffer type into the io_uring recycling path, potentially leading to memory corruption or other unintended kernel behavior. The description specifically notes that the legacy recycling logic failed to ensure the buffer list still existed and was correctly typed.

All Linux kernel releases that include the io_uring kbuf subsystem are affected because the vendor list only references Linux. No specific version range is provided, so any kernel build that has not integrated the fix may be vulnerable.

The CVSS score is 7.0 and the vulnerability is not listed in the CISA KEV catalog, indicating that no public exploit is known. However, the flaw requires the attacker to manipulate io_uring requests, likely by forcing work via the io‑work queue. If exploited, the lack of checks could lead to kernel memory corruption or stability issues. Because the EPSS score is not available, the predicted exploitation probability remains uncertain but should be treated as possible; high‑privilege processes that rely on io_uring are the primary target.