The flaw occurs when a DRBD peer replies with a P_DATA_REPLY that contains a payload length controlled by the peer. Because the length is signed, an attacker can force it to become negative. The kernel then performs a size calculation that underflows and casts the negative value to a very large size_t. When the kernel copies this payload into a bio page, it writes beyond the allocated buffer, corrupting kernel memory. Depending on the attacker’s goals, such memory corruption can lead to arbitrary code execution or a kernel panic. The vulnerability is only exploitable when the node is actively reading from a partner DRBD node, i.e. a diskless node or one that balances read traffic to the peer.

All Linux kernel installations that include the DRBD data‑replication block device are susceptible, regardless of kernel version or distribution, because the flawed code path exists in every release until the patch from the listed kernel commits is applied. No specific version constraints are provided in the CVE data.

The CVSS score is not supplied, and EPSS is unavailable, but the nature of the bug—unbounded kernel memory writes—implies a high severity. The vulnerability has been fixed in the kernel through a series of commits; however, until a system is updated, an attacker who can position himself as the DRBD peer or tamper with the network can trigger the fault. The vulnerability is not listed in CISA KEV, and no public exploitation has been reported, but the potential impact warrants immediate remediation.