The Linux kernel RAID5 code has an improper bounds check in the recovery functions that process journal metadata blocks. The payload size fields are used without verifying that the total payload fits within the remaining space of the metadata block, which can lead to out-of-bounds reads of kernel memory. Based on the description, it is inferred that an attacker could cause the kernel to read beyond the intended buffer, potentially exposing sensitive kernel data that would otherwise be protected by the operating system’s memory isolation. The weakness is a classic bounds-checking error (CWE-1284) that manifests as an out-of-bounds read rather than a write. The vulnerability does not directly provide code execution or privilege escalation, but it does increase the risk of information disclosure from kernel memory. While the developers have fixed the bug, the exposed read path remains a risk until the kernel image is updated with the patch.

All Linux kernel installations that include the mpblk RAID5 code are potentially vulnerable. The vendor product list and CPE indicate the entire Linux kernel family is affected, with no version exclusions noted. Therefore any system running a kernel build that contains the RAID5 journal recovery code could be impacted.

The CVSS score of 7.1 marks the flaw as high severity. The EPSS score is <1%, indicating a low but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting that large‑scale exploitation is not yet known. Based on the description, it is inferred that the attack would likely require a local or privileged user to create or corrupt a RAID5 journal block that the kernel processes. If an attacker can influence the journal contents, they may trigger an out‑of‑bounds read and obtain kernel memory data. The lack of public proof‑of‑concept exploits and the need for local interaction reduces the immediate threat but still warrants remediation.