The issue is a buffer overflow in the Linux kernel stack management. In 64-bit builds, the default thread stack size is insufficient for certain workqueue tasks, causing the kernel to detect a low stack condition and panic. This turns into a denial‑of‑service when the offending kworker thread overflows the stack, leading to a system reboot. The flaw is classified as CWE-787 and is limited to kernel‑level code. Attackers would need to run code with kernel privileges or exploit a loadable module, meaning local or privileged access is required.

All unpatched 64-bit Linux kernel builds, including mainstream distributions that ship the stock Linux kernel source without the 32 kB stack size change. The problem does not affect 32-bit kernels or kernels that have the patch applied. Any system that builds packages using GCC 17 on such kernels could trigger the overflow, as seen during the Debian vtk9 build.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of < 1 % and the absence from the CISA KEV catalog suggest a low likelihood of active exploitation in the wild. Local privilege escalation or the presence of a malicious module is required to reach the vulnerable code, and no known remote exploitation vectors exist. If an attacker successfully triggers the overflow, the kernel will panic and reboot, causing service downtime but not data exfiltration or persistence.