The Linux kernel's ring‑buffer allocator failed to initialize the bpage->order field in rb_allocate_cpu_buffer(). When a sub‑buffer larger than one page is allocated, the order remains 0, yet free_buffer_page() uses this value to decide how many pages to release. Consequently, the kernel frees an incorrect amount of memory, corrupting kernel data structures. The improper handling of buffer sizes (CWE‑908) can destabilize the system and potentially cause a crash or a denial of service.

All Linux kernel builds that contain the ring‑buffer component and allocate sub‑buffers larger than a page are vulnerable until the patch from commit 2e37f2bf111429fbfa4d985b12df3ba496ca70aa is applied. Any kernel released after that commit incorporates the fix and is considered safe.

The CVSS score is 5.5 and the EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need privileged access to trigger ring‑buffer operations that allocate oversized sub‑buffers and then free them. The likelihood of exploitation is low, but successful exploitation could corrupt kernel memory, potentially leading to denial of service or, with additional escalation, arbitrary code execution.