The kernel patch corrects a flaw where the launch‑time metadata size was not fully validated. Prior to the fix, an attacker could register metadata smaller than the full struct length and cause the kernel to process incomplete data, creating race conditions and memory corruption that could destabilize the system. The vulnerability does not provide a direct code execution vector but can lead to denial of service or unreliable network behavior.

All Linux kernel builds that lack the commit resolving the metadata size validation are affected. Organizations using unpatched kernels on any distribution should treat this as a security issue until the fix is applied.

No CVSS score is listed, and the EPSS score is not available, indicating that exploitation likelihood is not quantified. The vulnerability is not included in the CISA KEV catalog. Exploitation would require privileged or kernel‑level access to register malformed metadata, making it a low‑to‑moderate risk for typical systems. Nonetheless, the potential for memory corruption warrants prompt action.