The vulnerability arises in the Linux kernel’s ptrace subsystem where the dumpability flag, intended to indicate whether a process’s memory image can be core‑dumped, is mistakenly used as a generic permission test for ptrace operations even when the target task has no memory map. Because ptrace_may_access relies on this flag for checks unrelated to the memory map, a process that can call ptrace on a kernel thread can potentially read or modify that thread’s state. The check still enforces UID/GID matching and requires the CAP_SYS_PTRACE capability for overriding the flag, so only privileged users or processes with that capability can exploit the weakness. The impact is primarily the disclosure of kernel‑space data that would otherwise be protected from such processes.

Affected systems are all Linux kernel releases that have not yet integrated the commit that corrects the get_dumpable logic. The change is present in the mainline kernel, so any kernel older than the timestamp of that commit is vulnerable. This includes every architecture supported by the kernel family, such as x86_64, arm64, and others, regardless of distribution, as long as the underlying kernel code lacks the patch.

The CVSS base score and EPSS value are not provided, and the vulnerability is not listed in CISA’s KEV catalog. Because exploitation requires the CAP_SYS_PTRACE capability (or root privileges), the attack vector is local and limited to users who already possess elevated privileges. An attacker with such a capability can use ptrace to retrieve kernel thread information, resulting in information disclosure. The exploitation effort beyond having the capability is minimal, but the requirement for elevated privileges protects the vulnerability from general exploitation by normal users. The lack of a quantifiable score makes the risk assessment qualitative: systems that grant CAP_SYS_PTRACE widely or use low ptrace scope settings face a higher practical threat.