The vulnerability resides in the SUNRPC component of the Linux kernel. When processing Kerberos v2 wrap tokens, the kernel incorrectly trims a buffer based on an oversized encrypted count (ec) field. The buffer length is decreased using a value derived from the 16‑bit ec field, while the actual data length is often smaller. This can leave the memory in an inconsistent state, potentially leading to a buffer underflow when the kernel later accesses the truncated buffer. The impact is limited to the integrity and availability of the kernel process handling the RPC call; it does not directly provide code execution, but any fatal error in privileged context could cause a system crash.

All Linux kernel distributions are affected, as indicated by the generic CPE string for Linux kernel. No specific version ranges are provided, meaning with the fix is potentially vulnerable. The flaw spans the entire Linux vendor ecosystem, impacting all deployments that use SUNRPC with Kerberos authentication.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of < 1% suggests a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to possess a valid GSS context—either through legitimate access or credential compromise—and to transmit a malformed Kerberos v2 wrap token with an oversized ec field to the target RPC service. Based on the description, the likely attack vector is a network‑level exploit directed at an RPC endpoint that accepts Kerberos authentication. Because the bug only impacts kernel internals that trim buffer lengths, exploitation is limited to causing an invalid state and potential kernel crash, which could lead to denial of service or further exploitation if the crash can be leveraged for privilege escalation.