In Linux kernel code, when 8-byte alignment is forced, the calculation of a ring buffer event’s length omitted a 4‑byte subtraction for small events. As a consequence, the kernel reports each event as 4 bytes larger than it actually contains. This bug does not grant code execution or denial of service directly but can corrupt diagnostic data and potentially lead to misinterpretation of trace logs or downstream processing errors if an application consumes the ring buffer. The vulnerability originates from an incorrect length calculation within the event handling functions.

The issue is present in any Linux kernel configuration where RB_FORCE_8BYTE_ALIGNMENT is true, such as the riscv64 kernel with CONFIG_HAVE_64BIT_ALIGNED_ACCESS enabled. All impacted kernel versions that compiled with this option are affected, regardless of distribution.

No CVSS score is provided and the EPSS score is unavailable, indicating no publicly documented exploitation data. The likelihood of exploitation is low and the attack vector is local, requiring ability to invoke ring‑buffer operations such as ftrace or trace_marker_raw. Because the flaw only alters reporting of event size, it poses a data‑integrity risk rather than arbitrary‑code execution; therefore, the overall risk level is lower. The vulnerability is not listed in the CISA KEV catalog, which further suggests a lack of known widespread exploitation at this time.