A checkpoint/restore sysctl request for the next SysV IPC identifier is forwarded to idr_alloc() with no upper bound. When the tail of the valid IPC ID space is exhausted, the allocation can spill beyond the configured ipc_mni limit, creating an entry at an index outside the allowed range. The new ID is still encoded with the narrower SysV width, so later removal truncates the real index. This leaves a dangling pointer in the IDR, causing a use‑after‑free when the object is later accessed. The result is a kernel crash or, at minimum, kernel instability.

All Linux kernel versions that compile the checkpoint/restore feature (CONFIG_CHECKPOINT_RESTORE enabled) are vulnerable. The advisory references kernels from 3.8 through 7.1 and many distribution builds, indicating that any system running these kernels with checkpoint/restore active is susceptible unless the feature is disabled or the kernel updated.

The CVSS score of 7.8 indicates high severity, but the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The issue is not listed in the CISA KEV catalog. Attacking this vulnerability requires local access to the checkpoint/restore sysctl path; based on the description, it is inferred that the feature may not be enabled by default on many distributions. Successful exploitation could lead to a kernel crash; the potential for privilege escalation is not explicitly described in the provided information.