The vulnerability is a bug in the RISC‑V implementation of the kernel’s strnlen routine. The loop loads a word past the requested count before performing the aligned‑boundary check, which can cause the function to read a page that is unmapped. The fault results in a kernel exception that brings the system to a halt. Because the fault occurs in core kernel code, the impact is a local denial of service on any system that can invoke the code with an untrusted string or a suitably crafted count value.

The affected product is the Linux kernel running on RISC‑V processors, specifically any build that contains the buggy strnlen loop before the patch. The fix is provided in the kernel source tree and is applied in later kernel releases; production images should be updated accordingly.

The bug has no remote exploitation surface or privilege escalation path. The primary risk is that an attacker could trigger the fault by feeding a crafted count value to strnlen, resulting in a crash. Because the vulnerability is confined to the kernel library and does not give code execution, the only realistic consequence is local denial of service. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, so the probability of exploit in the wild is presumed low but a local denial of service remains a critical risk for affected installations.