The vulnerability causes an unsigned underflow in the loop that copies clipboard data into the terminal line discipline buffer, allowing the kernel to read up to 4094 bytes beyond the allocated selection buffer. This results in a slab‑out‑of‑bounds read that can expose kernel data and potentially trigger a crash through KASAN. The flaw does not directly execute code but can leak sensitive memory contents and lead to denial of service by exhausting kernel resources or causing instability.

All Linux kernel releases prior to the patch that addresses the paste_selection logic are affected. The CVE advisory lists the kernel product broadly; no specific version range is provided, so any system running a kernel prior to the patch that fixes the paste_selection logic is at risk.

The EPSS score of less than 1% and its absence from CISA’s KEV catalog indicate a very low probability of widespread exploitation. The CVSS score of 6.1 classifies the vulnerability as moderate severity, with potential for information disclosure and denial of service. Exploitation would require a process with permission to issue a TIOCL_SETSEL ioctl concurrently with a paste operation, which is a local or privileged scenario inferred from the described attack path. The impact is limited to information disclosure and possible service disruption rather than remote code execution.