Based on the description, the bug occurs while converting a kvec or user buffer into a scatterlist. The length of a scatterlist entry can unintentionally exceed a page boundary, and temporary use of the list for paging pointers can overlap with existing entries. These conditions allow unchecked memory writes in kernel space, potentially corrupting kernel memory and causing a system crash. This is a buffer overflow (CWE‑787) vulnerability.

The defect first appeared in kernel 6.3 and was moved to lib/scatterlist.c in 6.5. Thus the backported fix applies to backported kernels after 6.5. Therefore systems running any kernel version from 6.3 up to the point where the backport is applied remain vulnerable, while kernel 6.5 and later that include the patch are protected.

The CVSS score of 9.8 indicates high severity, and the EPSS score is < 1%, implying a very low but nonzero exploitation probability; consequently the baseline risk is low. Based on the description, the vulnerability requires kernel execution or the ability to influence kernel memory—typically a privileged or local attacker; this inference is based on the kernel‑space nature of the code. Because the affected code is exercised by normal kernel operations that handle user buffers, the likely attack vector is providing crafted user buffers through regular kernel interfaces, which could trigger a denial‑of-service. The absence from CISA’s KEV catalog indicates there are no known exploits in the wild at this time.