The vulnerability arises in the Linux kernel’s kho module, where kho_preserved_memory_reserve() calculates a preservation size by left‑shifting a 32‑bit integer. Because a 32‑bit integer can only shift up to 31 bits, the calculation works only for sizes up to 2 GiB. For larger sizes, the shift causes undefined behavior and can corrupt memory structures or crash the kernel. The weakness is categorized as CWE‑1335.

The flaw impacts all Linux kernel releases that include the kho module before the fix was merged, including the stable branch. Systems that request 2 GiB through kho_preserve_pages() or memblock reserve_mem are susceptible.

The CVSS score of 4.4 indicates low severity. The EPSS score is below 1 %, reflecting a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV. The likely attack vector is local privileged code that can request large preserved memory reservations, such as a kernel module or process running as root, which could result in memory corruption or kernel crash rather than remote code execution.