In this flaw, the loop counter in transfer_args_to_stack() can wrap around when the stack limit is insufficient, causing the code to read memory immediately before the argument array and copy an arbitrary address to the stack. This results in a kernel panic and a system reboot. The conditions require a vulnerable execve operation with a stack size limit below one page, occurring only in MMU‑free builds. The severity is moderate because the CVSS score is 4.7, but any user capable of invoking exec on such a kernel can trigger a denial of service; the likely attack vector is local execution.

The vulnerability affects Linux kernel configurations where the MMU is disabled (CONFIG_MMU=n). The code paths touched by the bug are used by binfmt_flat and binfmt_elf_fdpic under nommu conditions. The fix was introduced in the 7.2.0‑rc4 release, so any kernel prior to this patch that is built with MMU disabled is affected. Users running custom or custom‑built kernels that keep CONFIG_MMU=n for server or embedded deployments are at risk.

With a CVSS score of 4.7, the vulnerability is classified as moderate severity. The EPSS score is below 1% and the flaw is not in CISA KEV, indicating no widespread exploitation in the public domain yet. However, because a single user can trigger a kernel panic by performing a malicious execve on a nommu kernel, the risk of accidental or intentional denial of service remains significant. The exploit requires only local access and a non‑typical kernel configuration, but for users relying on nommu builds the threat is real.