The vulnerability originates from a race condition and out‑of-bounds write in the Linux kernel ring‑buffer subsystem. When a user maps a ring buffer with resizing disabled, a concurrent sub‑buffer order change can occur. The kernel updates the order before confirming that all CPUs allow resizing; subsequently, a mapping established by __rb_map_vma reads the new sub‑buffer order without proper synchronization. This allows a buffer to be resized to an improper size, causing the kernel to insert pages beyond the intended sub‑buffer limits. The result is an out‑of‑bounds memory write (CWE‑787) that potentially corrupts kernel memory and undermines kernel integrity.

All Linux kernel releases include the ring‑buffer implementation referenced in the provided commit logs. No specific version range is supplied, so any kernel that incorporates the unpatched code is considered vulnerable until the patch is applied.

Based on the description, the likely attack vector is a local user race condition created by concurrent memory mapping of a ring buffer with resizing disabled while a sub‑buffer order change occurs. The EPSS score is < 1% and the vulnerability is not listed in CISA KEV, indicating no publicly known exploit. The CVSS score of 5.5 indicates moderate severity, but kernel memory corruption still carries significant concern; an attacker with local privileges could exploit the race condition to corrupt kernel memory.