The Linux kernel vulnerability allows a local user to register the shadow stack or other special virtual memory areas with the userfaultfd interface. By invoking the UFFDIO_COPY ioctl, the attacker can inject arbitrary content into these protected regions, overwriting return addresses or other control data. This results in a kernel‑level write to protected memory that can be leveraged to execute arbitrary code with elevated privileges.

All kernel versions that include the userfaultfd system call and have not applied the patch to reject VM_SHADOW_STACK and VM_SPECIAL are affected. The flaw is inherent to the kernel code and is independent of distribution or particular modules; any system running an unpatched kernel that uses userfaultfd can potentially exploit it.

The vulnerability provides a local user with a write‑to‑kernel memory capability, enabling privilege escalation. With a CVSS score of 7.0 the potential impact is moderate, but achieving arbitrary code execution in kernel space is severe. The EPSS score of < 1% indicates a very low likelihood of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, yet its nature warrants timely remediation.