In the Linux kernel, the stack slot index used for the speculative‑execution sanitization pre‑check does not match the index used during the actual write. For a 4‑byte write to an address such as fp‑8 after the lower half of that slot has been zeroed, the pre‑check examines bytes 0..3 and marks the slot as zeroed while the write updates bytes 7..4. This mismatch can allow a write to bypass the nospec check, enabling unsafe updates to kernel memory or potentially leaking data during speculative execution.

All Linux kernel versions that contain the unpatched code are affected. The issue is in the generic kernel source and applies to any distribution that ships the kernel without this patch. Distribution‑specific kernel releases that have not applied the commit are vulnerable.

Based on the description, it is inferred that the most likely attack vector involves executing privileged kernel code, such as an exploit that triggers a 4‑byte stack write that can bypass the mis‑indexed nospec check. The CVSS score of 5.5 indicates a moderate severity, and the EPSS score is < 1%, suggesting a low probability of exploitation. The flaw is not listed in CISA KEV, implying that a successful exploit would require the attacker to gain kernel‑level access to craft the specific memory write that meets the conditions highlighted in the description.