The Linux kernel suffers from a bug in the vsock subsystem where the buffer size clamping logic incorrectly applies the maximum constraint after the minimum constraint. When a user specifies a minimum buffer size larger than the configured maximum, the exceeding minimum silently overrides the maximum, allowing the socket buffer to grow beyond the allowed maximum. This violation can cause the socket memory to exceed intended boundaries and potentially exhaust memory or trigger undefined behavior. The primary risk is a denial of service on the host system.

The affected kernel is any Linux kernel that includes the vsock implementation and has not applied the fix referenced in the Git commit logs. The Common Platform Enumeration string indicates all variants of the Linux kernel. The specific kernel versions impacted are not enumerated in the input, so any release that predates the commit that implements the fix is potentially vulnerable.

The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. The CVSS score is not provided, so the severity cannot be quantified from the data. The exploit route is unclear from the description, but the logic flaw requires control over the vsock buffer size settings, implying a local or privileged user context; however the impact of exceeding the buffer size could affect system stability. In the absence of a public exploit, the risk is primarily theoretical until demonstrated; administrators should consider the potential for denial of service in environments that rely on versus sockets.