The flaw occurs when the ARM LPAE unmap routine returns a signed error value through a size_t return type, causing the negative value to be interpreted as a huge unsigned number. This corrupted value propagates through the call chain, eventually producing a mis‑aligned address that triggers a BUG_ON and leads to a kernel panic. The weakness is identified as CWE‑617: Incorrect Check or Handling of Error Condition. The description does not indicate a pathway to arbitrary code execution or privilege escalation.

All Linux kernels built from the 6.19 source tree before the patch are vulnerable. This includes the 6.19 release candidates up to rc6 and any distribution kernel that has not integrated the fix. The issue applies to the iommu/io‑pgtable‑arm implementation on those kernels.

The CVSS score of 5.5 classifies the item as moderate severity while the EPSS score of less than 1 % indicates a very low probability of exploitation. Based on the description, it is inferred that the bug requires interaction with the IOMMU subsystem, which is normally limited to privileged kernel code or device drivers, making remote exploitation unlikely. Nonetheless, any legitimate driver that invokes unmap on an unmapped page table entry can immediately trigger a kernel panic. The vulnerability is not listed in CISA’s KEV catalog, so no known active exploits exist at present.