In the Linux kernel, the ring-buffer allocator omitted initialization of the page order field in rb_allocate_cpu_buffer. The resulting order value stayed at zero, yet it is used by free_buffer_page to determine how many pages to free. When a sub-buffer is larger than one page, the wrong free size corrupts memory. This defect can destabilise the kernel and lead to a system crash, representing a low-level memory corruption issue. The vulnerability is not directly exploitable via user input but can be triggered through privileged ring-buffer operations, potentially causing denial of service or system instability.

All Linux kernel builds that contain the ring-buffer component and allocate sub-buffers larger than a page are affected until the fix is applied. The bug was resolved in commit 2e37f2bf111429fbfa4d985b12df3ba496ca70aa, so any kernel released after that commit is considered safe.

No CVSS score or EPSS value is available, and the vulnerability is not listed in the CISA KEV catalog. Public exploitation has not been reported. An attacker would need to trigger ring-buffer paths that allocate oversized sub-buffers and then release them, a scenario that typically requires privileged access. Therefore, the likelihood of exploitation is low, but a successful exploitation could corrupt kernel memory and destabilise the system.