The patch reveals that the userfaultfd interface permits registration on shadow stack and other special virtual memory areas. By performing a UFFDIO_COPY operation, a local user can inject data directly into these protected regions, overwriting return addresses or other control data. This yields kernel‑level arbitrary memory write and the ability to execute arbitrary code in privilege‑elevated context.

All Linux kernel builds that ship the userfaultfd system call are affected. The vulnerability is independent of distribution; any system running an unpatched kernel that includes the pre‑fix code can register shadow stack or special VMAs and exploit the flaw.

Because the flaw allows a local user to write to kernel memory, it is a high‑impact privilege escalation vulnerability. The EPSS score is not available, but the nature of the bug suggests a significant likelihood of exploitation in environments where userfaultfd is enabled. It is not listed in the CISA KEV catalog, yet the severity warrants immediate attention.