The bug occurs while converting a kvec or user buffer into a scatterlist. The length of a scatterlist entry can unintentionally exceed a page boundary, and temporary use of the list for paging pointers can overlap with existing entries. This results in unchecked memory writes in kernel space, potentially corrupting kernel memory and causing a system crash. An attacker who can influence the data passed to the affected routine could trigger these out‑of‑bounds writes to destabilize the system.

The defect first appeared in kernel 6.3 and was moved to lib/scatterlist.c in 6.5. The backported fix applies to backported kernels after 6.5. Therefore systems running any kernel version from 6.3 up to the point where the backport is applied remain vulnerable, while kernel 6.5 and later that include the patch are protected.

No CVSS score is published and the EPSS score is not available; consequently the baseline risk appears low from a public exploitation standpoint. The vulnerability requires kernel execution or the ability to influence kernel memory—typically a privileged or local attacker. Because the affected code is exercised by normal kernel operations that handle user buffers, a locally privileged attacker could use other kernel interfaces to trigger the bug, resulting in a denial‑of‑service. The absence from CISA’s KEV catalog indicates there are no known exploits in the wild at this time.