The move_pages_huge_pmd function in the Linux kernel mishandles a NULL folio when moving huge zero pages. This bug causes a bogus page frame number to be written into a PMD entry, pointing to non-existent memory or causing a NULL dereference. An attacker who can invoke the UFFDIO_MOVE ioctl can trigger a kernel crash or memory corruption, resulting in a denial of service and potential corruption of data used by other processes.

Linux kernels that contain the buggy move_pages_huge_pmd implementation are affected. The exact affected release series is not listed in the advisory, so any kernel version prior to the commit that introduces this fix is potentially vulnerable.

The CVSS score is not available in the advisory and the EPSS score is missing, so the precise risk level is unclear. However, the vulnerability involves a kernel memory corruption scenario that can be triggered via a privileged ioctl. In environments where an attacker can reach kernel space—such as a local privileged user or a compromised device—the risk of a crash or data corruption is high. The vulnerability is not currently listed in CISA’s KEV catalog, indicating no publicly known active exploitation at this time.