The Linux kernel contains a flaw where the bip_vcnt value is overwritten during a copy operation, causing the bounds check in block/blk.h to read past the end of the bip_vec flex array. This out-of-bounds read is a classic instance of CWE-125 and could expose kernel data or user data that should otherwise remain private.

All Linux kernel releases that do not incorporate the commit which fixes the bip_vcnt overwrite are vulnerable. The advisory does not list specific kernel versions, so any kernel installed before the patch is potentially affected.

The CVSS score of 7.8 indicates moderate-to-high severity, while an EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The bug is likely exploitable by a local attacker who can invoke the kernel path that triggers bio_integrity_copy_user(); an out-of-bounds read could then expose sensitive kernel or user memory. No remote exploitation vector is described in the provided data.