The Linux kernel's dibs loopback move_data() function performed a memcpy into a registered Direct Memory Buffer (DMB) without validating that the sum of offset and size stayed within the buffer's allocated length. Unlike real ISM hardware, which enforces memory region bounds, the software loopback lacked such protection. This allowed a peer to supply an out-of-bounds offset or an oversized write, resulting in an out-of-bounds write past the kernel buffer. The vulnerability was resolved by adding explicit bounds checks before the memcpy call, causing invalid requests to be rejected with an -EINVAL error.

An attacker able to supply crafted offset and size values to the loopback move_data() function could cause an out-of-bounds write in kernel memory. This could lead to memory corruption, potentially destabilizing the kernel or enabling privilege escalation. However, the vulnerability is limited to the dibs loopback driver and requires interaction with this specific kernel component.

A fix has been implemented that adds explicit bounds checking in the move_data() function to prevent out-of-bounds writes. Users should update their Linux kernel to a version that includes this patch once it is released. Patch status is not yet confirmed in the provided data; check the vendor advisory for current remediation guidance.