The bug is in the Linux kernel ring-buffer implementation. When sub‑buffers are created with an allocation order greater than zero, the free callback cpu_buffer::free_page is allocated using that same higher order instead of the intended base order. This incorrect deallocation mismatches allocation and free sizes, which can corrupt kernel memory or result in unintended behavior. The flaw is classified as CWE‑763.

All Linux kernel builds that contain the affected ring‑buffer code are potentially impacted. The CVE does not specify a particular kernel release; any distribution that has not applied the patch that resolves the incorrect free_page order remains vulnerable.

The CVSS score is 4.4 and the EPSS score is < 1 %, meaning a low probability that the flaw is actively exploited. The vulnerability is not listed in the CISA KEV catalog. While the description does not state a specific attack vector, the flaw involves a kernel memory deallocation mismatch, so a malicious entity would need to trigger the ring-buffer code with sub-buffer orders greater than zero. This identifies the risk as moderate with low likelihood of exploitation under current conditions.