The Linux kernel block subsystem had a vulnerability where bio_integrity_copy_user() overwrote the bip_vcnt field, which is set by bio_integrity_add_page() to 1 for the bounce segment. Overwriting bip_vcnt with nr_vecs broke the condition bip_vcnt <= bip_max_vcnt on WRITE operations, causing gap-merge checks to read past the bip_vec[] flexible array, resulting in out-of-bounds memory access. On READ operations, the read was within bounds but accessed incorrect data (a saved user bvec instead of the bounce). The problematic code line was introduced for split propagation, but bio_integrity_clone() does not copy bip_vcnt, and BIP_CLONE_FLAGS excludes BIP_COPY_USER, leading to this inconsistency. This vulnerability has been resolved in the Linux kernel.

The vulnerability could lead to out-of-bounds memory reads on WRITE operations and incorrect data reads on READ operations within the Linux kernel's block subsystem. This may cause memory corruption or data integrity issues affecting block I/O operations. No known exploits in the wild have been reported.

A fix for this vulnerability has been implemented in the Linux kernel. Users and administrators should apply the official kernel updates that include this patch to remediate the issue. Since this is a kernel-level vulnerability, upgrading to a patched kernel version is the recommended mitigation. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisories for the exact fixed versions and update instructions.