The vulnerability is a buffer overflow in the Linux kernel's device mapper ioctl handling routine retrieve_status. The code aligns a pointer without checking bounds, allowing the pointer to exceed the intended output buffer and write beyond it. While only root users can issue device mapper ioctls, the overflow could corrupt kernel memory or trigger a crash if the buffer alignment is violated. The vendor notes that the commonly used libraries provide 8‑byte aligned buffers, preventing incidental exploitation.

The flaw exists in the kernel's device mapper subsystem and affects all Linux kernel installations that have not applied the latest upstream commit. Specific affected versions are not listed, so administrators should ensure the kernel is patched to the latest stable release available from their distribution or upstream.

The issue carries no documented exploitation and is restricted to privileged users; therefore the immediate risk is low. Because EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, the likelihood of real‑world attacks is assumed minimal. Nonetheless, an attacker with root privileges who intentionally misuses unaligned buffers could exploit it to overwrite memory, but standard usage with aligned buffers mitigates this risk.