The Linux kernel’s vmalloc subsystem contains a buffer overflow in the vrealloc_node_align function. When a buffer is resized to a smaller size, the routine copies the full old length bytewise into the new allocation. If the new allocation is smaller than the old, this results in an out‑of‑bounds write past the end of the destination buffer, corrupting kernel memory. The corruption can lead to a kernel crash, denial of service, or alteration of kernel state that could be leveraged for privilege escalation. The flaw is specifically tied to the need_realloc path that forces a new allocation when the current pointer is on the wrong NUMA node or does not meet alignment requirements, even for shrink operations.

Any Linux kernel build that has not incorporated the commit that limits the copy length is affected. Because the vulnerability is addressed in a commit included in the mainline kernel, all stock Linux distributions shipping with a kernel older than that commit—and any custom kernels that exclude the update—fall within the scope. The relevant CPE identifiers indicate a broad range of Linux kernel releases, including version 7.1 release candidate 1 and all earlier kernels.

With a CVSS score of 7.8, the flaw represents medium‑to‑high risk. The EPSS score is listed as less than 1 %, indicating that the probability of exploitation is very low at the time of analysis. It is not catalogued in CISA’s KEV list. Based on the description, it is inferred that exploitation would require local or privileged system access to invoke the vulnerable routine; the vulnerability description does not explicitly state the required attack vector, so that assessment is an inference rather than a direct statement from the CVE data.