Linux Kernel EUVD-2026-27807

The vulnerability requires all of the following conditions: (1) Attacker must have local system access as an unprivileged user with capability to create AF_KCM sockets (SOCK_SEQPACKET type), (2) The message assembly must exceed MAX_SKB_FRAGS (17 fragments) to trigger new skb allocation in frag_list, (3) Data copy must fail partway through (typically via invalid user memory pointer causing -EFAULT), (4) For SOCK_SEQPACKET, the message must be completed via a subsequent write() call (MSG_EOR is set automatically by sock_write_iter), (5) The KCM socket must have accumulated enough data to transition to kcm_write_msgs() processing. This is not remote-exploitable-AV:L in CVSS correctly restricts to local attackers. Default Linux configurations generally have KCM available but unused, so exploitation requires the attacker to intentionally use this subsystem. Systems where KCM sockets are never created are unaffected despite kernel presence.

CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates local, low-complexity, unauthenticated-but-privileged attack requiring local account access and high availability impact. However, EPSS 0.02% (5th percentile) reflects very low real-world exploitation probability despite the moderate CVSS score, suggesting this is a niche edge case requiring specific socket programming knowledge and intentional trigger conditions. The gap between CVSS and EPSS indicates this is a 'noisy' vulnerability rather than a practical attack vector. Exploitation requires: (1) local system access as an unprivileged user, (2) knowledge of KCM socket semantics, (3) ability to trigger -EFAULT during data copy (requires passing invalid user memory pointers), and (4) subsequent message completion via zero-length write. The attack does not grant privilege escalation, code execution, or data breach-only denial of service via kernel warning. The WARN_ON_ONCE() change further reduces severity by limiting log flooding. Systems without KCM sockets in active use (most production systems) face minimal risk. Patch availability and low EPSS suggest this should not be a high-priority patch cycle urgency, though it should be included in routine kernel updates.

A local attacker with unprivileged user access opens a KCM socket (SOCK_SEQPACKET) and sends a message with crafted payload. The message is constructed to exceed MAX_SKB_FRAGS (17 fragments) to trigger new skb allocation. The attacker passes an invalid user memory pointer so the data copy fails with -EFAULT after the new skb is linked into frag_list but before any fragments are filled. The partial message is saved. A subsequent zero-length write() completes the message, queuing it to sk_write_queue. When the kernel processes this message via kcm_write_msgs(), it hits the zero-fragment skb in frag_list, triggering the kernel warning and potentially causing a crash or denial of service. A proof-of-concept reproducer is available at the referenced GitHub gist.