During binfmt_misc handler registration, if the delimiter used to split fields is also one of the flag characters, the parser misinterprets the padded buffer. The flag parser consumes only flag characters and expects the trailing delimiter to terminate the scan. When the delimiter is a flag character, the padding no longer marks a boundary, causing the parser to read past the buffer end. This results in an out-of-bounds read of kernel memory, which may reveal sensitive data or, with an unlucky memory layout, touch unmapped pages and trigger a kernel crash. No privilege escalation or code execution is achieved; the attack is limited to local memory disclosure and potential instability.

Based on the description, it is inferred that all Linux kernel releases prior to the patch that rejects flag characters as valid delimiters are affected. The flaw is present whenever a binfmt_misc mount is available to unprivileged users within a user namespace, allowing local users to create a handler. The vulnerability is not tied to a specific exact version, so any kernel that exposes binfmt_misc in this fashion is likely impacted until the patch is applied.

The CVSS score of 7.1 indicates high severity, while the EPSS score of <1% signifies a very low exploitation likelihood. The vulnerability is local – an attacker must be able to run code on the target machine, such as a local user in a user namespace, and must craft a registration string with a delimiter that is a flag character. In practice, this limits exposure to systems where binfmt_misc mounts are permissively configured for unprivileged users. The risk is primarily confidentiality leakage of kernel memory and a moderate availability impact if an access failure occurs. Because the vulnerability is not remote and does not grant elevated privileges, it is considered a lower overall threat than remote code execution flaws but still warrants timely remediation.