An out‑of‑bounds write occurs in the Linux kernel's loopback move_data() routine when a peer provides an offset or size that exceeds the allocated DMB buffer. The unverified memcpy writes past the buffer, corrupting kernel memory. The documented consequence is kernel memory corruption that could potentially destabilize the system; no explicit evidence indicates it directly leads to arbitrary code execution.

This flaw resides in all Linux kernel versions that include the loopback move_data routine without the bounds check introduced in commit 78237e3c0720fcc6eb9b87e90fd70f63eeca886f. The specific version range is not enumerated in the advisory; consequently any unpatched kernel that predates that commit is potentially vulnerable. Users of the loopback device across all standard distributions that ship an affected kernel are impacted.

The vulnerability requires an attacker to invoke loopback device operations with crafted parameters, implying a local or permission‑elevated context. It is not listed in CISA's KEV catalog, but the EPSS score indicates a low probability (<1%) of exploitation, so the likelihood of active exploitation remains low. Nevertheless, the kernel memory corruption that the flaw permits constitutes a high‑severity risk, warranting prompt patching.