The flaw originates in the arch_set_shadow_stack_status() routine on ARM64. When alloc_gcs() fails, it returns an error‑encoded pointer that should be detected with IS_ERR_VALUE(). The routine incorrectly checks only for a NULL pointer, allowing an error pointer to be interpreted as a valid GCS address. Using this invalid address can cause the kernel to read from or write to an unintended region, leading to memory corruption or a kernel panic. This weakness is categorized as CWE‑390 (Error Handling).

Any Linux kernel running on ARM64 hardware that does not yet contain the commit adding IS_ERR_VALUE() error checking is vulnerable. The advisory does not specify particular release numbers, so any build before the patch is affected. The vulnerability applies across all Linux distributions that ship the kernel for ARM64, except where the kernel version includes the fix.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. Because the flaw requires a failure in alloc_gcs() and subsequent use of the error pointer, it likely needs local privileges or a specific trigger such as a kernel memory mapping operation. The vulnerability is not listed in the CISA KEV catalog, and no public exploit is currently known. Overall, the risk is moderate but warrants timely remediation.