The Linux kernel function mask_user_address() mistakenly checks for the CONFIG_E500 symbol instead of the correct CONFIG_PPC_E500. This logic error prevents the optimized mask_user_address_isel() routine from executing on PowerPC E500 hardware, causing the kernel to apply incomplete address masking for user‑supplied addresses. The resulting insufficient masking could allow the kernel to read or write beyond intended bounds, potentially leading to memory corruption or unauthorized access to kernel memory. The flaw is a manifestation of CWE‑1025, a static analysis failure, which creates a functional defect at the source level.

All Linux kernel builds that compile for PowerPC E500 processors and contain the faulty CONFIG_E500 check are affected. The issue exists in any kernel version that includes the incorrect conditional before the patch is applied. Systems running such kernels on PowerPC E500 hardware are at risk unless the source is rebuilt with the corrected check or an updated kernel is deployed.

The CVSS score of 7.8 indicates high severity, while the EPSS score of < 1% suggests that exploitation is very unlikely at present. The vulnerability is not listed in the CISA KEV catalog and no public exploits are known. Because the flaw resides in kernel code, an attacker would need local or privileged access to the machine in order to exploit it. The likely attack vector is local; remote exploitation would be improbable without first obtaining local foothold.