The Linux kernel’s vmalloc subsystem contains a buffer overflow flaw in the vrealloc_node_align function. When resizing a buffer to a smaller size, the function copies more bytes than the new allocation holds, writing past the end of the destination buffer. This out‑of‑bounds write corrupts kernel memory and can cause a crash or alter kernel state, potentially enabling privilege escalation.

Any Linux kernel build that has not incorporated the commit that limits the copy length is affected. Since the commit is part of the mainline kernel, the vulnerability applies to all stock Linux distributions that ship with a kernel older than the commit. Distribution references are not enumerated, so the specific affected release series may vary.

With a CVSS score of 7.0, the flaw represents a medium‑to‑high risk. The EPSS score is not available and it is not listed in CISA’s KEV catalog. Exploitation requires local or privileged system access to execute code that calls the vulnerable routine. Successful exploitation would corrupt kernel memory, potentially leading to denial of service or privilege escalation.