The Linux kernel’s transparent hugepage subsystem incorrectly permits THP collapse for files that reside on anonymous inodes, such as guest_memfd and secretmem, when CONFIG_READ_ONLY_THP_FOR_FS is enabled. This results from a buffer handling error combined with an input validation weakness (CWE‑825) because the kernel fails to exclude pseudo‑filesystem objects from THP eligibility. When collapse is attempted, the guest_memfd fault handler or the secretmem copy routine faults on large folios, which can trigger WARN_ON_ONCE or a full kernel crash. The flaw does not provide arbitrary code execution, but it can bring the host down through a denial‑of‑service that is triggered by the kernel’s own memory management path.

All Linux kernel releases compiled with CONFIG_READ_ONLY_THP_FOR_FS enabled and that have not incorporated the upstream patch (commit 0524ee56f) are affected. This includes mainstream distribution kernels that expose guest_memfd or secretmem or otherwise allow THP collapse on pseudo‑filesystem inodes. The vulnerability applies to the core kernel regardless of vendor; any distribution kernel using the default configuration for THP on read‑only files can be impacted.

The CVSS base score of 7.0 indicates high impact while the EPSS score is under 1%, implying a low prevalence of active exploitation today. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers would need local access to create or interact with the vulnerable pseudo‑FS objects and to enable transparent hugepage collapse for them, making exploitation a local attack. Given the severity and the possibility of a kernel crash, the vulnerability should be treated as a high‑priority patching issue.