In the Linux kernel, the dm ioctl interface allows a root user to request a buffer that is too small for the kernel to safely copy back user data. The kernel calculates an offset that is seven bytes beyond the end of the allocated structure, causing an out‑of‑bounds read of kernel memory. Only a system with root privileges can trigger the bug, and the data leaked is whatever is adjacent to the allocation, typically kernel data that a privileged user could otherwise read. The vulnerability does not allow unprivileged users to execute code or elevate privileges; it merely leaks a small amount of kernel memory to root.

All versions of the Linux kernel that contain the dm ioctl code before the patch commit that clamps data_start to the actual buffer size. The precise affected releases are those for which the commit identified in the references has not yet been merged, so any kernel sourced from the stable repository before that change is at risk.

Because the exploit requires root, the risk to typical unprivileged workloads is negligible. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no current exploitation activity. However, any compromised system that obtains root could leverage the out‑of‑bounds read to observe kernel memory, which may aid further attacks. The CVSS score is not supplied, but the inherent severity is moderate for a root‑only data‑leak scenario.