The vulnerability is located in the Linux kernel’s dm raid1 device manager. When building constructor strings, the code fails to allocate space for the terminating NUL byte after converting a 64‑bit value to decimal. This results in a buffer overflow inside a call to sprintf, which can corrupt adjacent stack or heap data. An attacker that can supply a crafted dm raid1 configuration string during pool creation or module load could trigger this overflow and potentially destabilize the kernel or execute arbitrary code depending on the local privileges and environment.

The flaw affects the Linux operating system kernel; any installation that loads the dm raid1 module before the patch is applied is potentially vulnerable. No specific kernel releases are listed, so all kernels that have not yet integrated the fix are in scope, including older or unsupported versions that still ship the vulnerable code.

The CVSS score of 4.7 indicates a moderate risk. The EPSS score is below 1%, implying a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread, documented attacks. The likely attack vector is local: an attacker must have the ability to influence dm raid1 configuration strings, which typically requires kernel privilege or local root. Even so, the low exploitation probability combined with the lack of known threats means this issue is not an imminent blanket threat, but it merits patching to prevent potential local compromise.