A flaw in the Linux kernel’s kho memory allocation routine causes scratch page blocks to be rounded incorrectly when a fixed size is supplied from the command line, while a scaled size is rounded correctly. The result is that the kernel may release a page block that is only partly marked as scratch. This partial release can leave unused memory fragments within the block, which later allocations may reuse, potentially leading to memory corruption or data integrity issues. The vulnerability is not a direct code execution vector, but it can be exploited by a local attacker capable of setting scratch sizes or by malicious kernel modules that manipulate the allocation parameters.

Any Linux kernel installation that has not incorporated the fix referenced in commit 0e39380a7. This includes generic Linux distributions where the kernel build process includes the older kho code path. Without version specifics from the CNA, all kernels that lack the patch are considered vulnerable, regardless of distribution or release level.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of < 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, further indicating it has not been widely exploited. Attackers would need local privileges or the ability to load kernel modules to manipulate scratch sizes, limiting the threat to environments where such access is granted. As a result, the risk remains moderate and should be addressed with an immediate patch.