In this flaw, the loop counter in transfer_args_to_stack() can wrap around when the stack limit is insufficient, causing the code to read memory immediately before the argument array and copy an arbitrary address to the stack. This results in a kernel panic and a system reboot. The described conditions require a vulnerable execve operation with a stack size limit below one page, occurring only in MMU‑free builds. The severity is high because any user capable of invoking exec on such a kernel can trigger a denial of service; the likely attack vector is local execution.

The vulnerability affects Linux kernel configurations where the MMU is disabled (CONFIG_MMU=n). The code paths touched by the bug are used by binfmt_flat and binfmt_elf_fdpic under nommu conditions. The fix was introduced in the 7.2.0‑rc4 release, so any kernel prior to this patch that is built with MMU disabled is affected. Users running custom or custom‑built kernels that keep CONFIG_MMU=n for server or embedded deployments are at risk.

No EPSS score is available and the bug is not listed in CISA KEV, indicating that public exploit data is not yet known. However, because the flaw leads to a kernel panic on a local execve, the risk of accidental or intentional denial of service is significant. The exploitability requires only local access and a non‑typical kernel configuration, but for users who rely on nommu builds the threat is real. Organizations should treat this as a high‑severity issue for systems that might run kernels without a memory management unit.