In the Linux RISC‑V kernel, this flaw relates to CWE‑822, where the kernel fails to validate the user pointer after untagging before performing atomic operations. The mismatch between the tagged address ABI and the atomic futex operations allows a userland process to perform an untagged pointer check while the kernel subsequently executes an atomic instruction on the original, still‑tagged address, creating a race that can be used to read or write arbitrary kernel memory. This flaw directly enables privilege escalation, because an attacker can manipulate kernel data structures and potentially gain full control of the system.

Vulnerable systems are those running the Linux kernel on RISC‑V architectures with the tagged address ABI enabled (CONFIG_RISCV_ISA_SUPM set and the PMLEN configuration non‑zero). Any kernel build that has not yet incorporated the patch may be affected.

The CVSS score is 7.8, and the EPSS score is < 1%. The vulnerability is a classic kernel privilege escalation that provides a read/write oracle over kernel space, yet it is currently not listed in the CISA KEV catalog. Attackers would need to enable the tagged address ABI (CONFIG_RISCV_ISA_SUPM) and use the futex system call with an appropriate operation to exploit the glitch. Because the exploit writes to kernel memory, it is likely easy for an attacker to learn the exact kernel address to target, posing a significant risk.