The vulnerability arises in the arm64 architecture of the Linux kernel where a user memory type is incorrectly extracted in ioremap_prot(). This leads to the creation of a user-space mapping that the kernel later accesses, causing a fault on systems with PAN and resulting in a kernel crash. The attack results in denial of service because the fault terminates the affected process or can destabilize the entire system.

This flaw affects all arm64-based Linux kernel installations that have not applied the patch that corrects ioremap_prot() to extract only the memory type and assert the correct mapping type. No specific kernel release numbers are listed in the data, so administrators should assume that any kernel prior to the commit that resolves the issue is vulnerable.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score below 1% suggests that, while it could be exploited, it is not widely used in the wild. The vulnerability is not in the CISA KEV catalog. Exploitation would most likely require local privilege or a vulnerable driver to supply an incorrect pgprot_t; remote exploitation is unlikely unless the attacker can influence kernel memory mappings through a device interface.