The Linux kernel contains a bug in the arm64 GCS page mapping logic. When the FEAT_LPA2 feature is enabled, the high bits of the page table entry that should carry the shareability attribute are overwritten by address bits. The PAGE_GCS macros mistakenly set the PTE_SHARED bits to 0b11, which under LPA2 triggers a page fault that escalates into a kernel panic. The result is a denial of service because the kernel process crashes, disabling the whole system or virtual machine.

Affected products are Linux kernels running on arm64 platforms that have the LPA2 feature enabled. Any system using Linux 7.0.0-rc1 or the same release series will be impacted until the mapping fix is applied.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1 % suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to run or enable GCS on a system with LPA2 enabled, which typically requires privileged access or a bug that allows triggering the GCS write fault. The exploit path is a local privilege or configuration error that leads to a kernel panic; once the condition is met, an attacker can surface the denial of service.