The Linux kernel vulnerability addressed involves the handling of pseudo-filesystems initialized by init_pseudo(). Prior to the fix, pseudo-filesystems did not have the SB_I_NOEXEC flag set by default, causing warnings when anonymous-inode files backed by dma-buf were mmap'd with executable permissions under CONFIG_DEBUG_VFS=y. The patch sets SB_I_NOEXEC and SB_I_NODEV flags by default in init_pseudo(), ensuring that executable mappings of pseudo-filesystem file descriptors fail with -EPERM, maintaining kernel security invariants. This change prevents misuse of executable mappings on pseudo-filesystems that are not path-reachable and enforces expected behavior without affecting in-tree callers, which do not map these files executable.

The vulnerability could allow executable memory mappings of pseudo-filesystem file descriptors that should not be executable, potentially violating kernel security assumptions. The fix enforces that such mappings fail, preventing unauthorized executable mappings. No known in-tree callers perform executable mappings of these pseudo-filesystems, and no known exploits are reported in the wild. The impact is primarily on kernel integrity and enforcement of expected behavior for pseudo-filesystems.

The vulnerability has been resolved by setting SB_I_NOEXEC and SB_I_NODEV flags by default in the init_pseudo() function in the Linux kernel. Users should update to a kernel version that includes this fix. Since this is a kernel-level change, applying the official kernel update from the vendor or distribution is the recommended remediation. Patch status is not explicitly stated but the fix is committed in the kernel source. Check the vendor or distribution advisory for the exact fixed version and update accordingly.