The Linux kernel fails to set the SB_I_NOEXEC flag on pseudo-filesystems created by init_pseudo(). When a file backed by an anonymous inode or dma‑buf is memory‑mapped from such a superblock, the lack of the flag triggers a debug warning but the internal assertion ultimately returns –EPERM for executable mappings. Thus the vulnerability does not allow an attacker to run code, but it can cause unnecessary warnings and prevents mappings that would otherwise succeed under normal configurations.

Linux kernel builds prior to the inclusion of commit 1e7ab6f67824. The issue manifests only when the CONFIG_DEBUG_VFS option is enabled and when applications use dma‑buf or anonymous‑inode files with pseudo filesystems such as ramfs or tmpfs created by init_pseudo().

The bug does not provide a direct path to code execution and is limited to denial of mapping and debug output. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation would require local access and a precisely crafted environment to trigger the debug assertion, resulting in low overall risk.