In the Linux kernel, the netfs module’s netfs_extract_user_iter() function had a bug where an overrun of the pages[] array by iov_iter_extract_pages() would allow the overfilled pages to be included in the iterator. The bug does not prevent the memory corruption that has already occurred; instead, it enables the corrupted data to be exposed or accessed by the rest of the kernel.

All Linux kernel versions that include the netfs module and have not yet applied the series of commits that fix the overrun check are affected. The CPE list indicates that the issue applies to the general Linux kernel and to kernel 7.1 releases 1 to 4. No specific version numbers are provided in the official data, so any kernel prior to the application of the fix is potentially vulnerable.

The CVSS score of 7.8 classifies this flaw as high severity. The EPSS score of less than 1% shows a very low likelihood of public exploitation, and the vulnerability is not listed in the CISA KEV catalog. It presumably requires local access to trigger the overrun and memory corruption, but no publicly available exploits or reports of exploitation have been documented.