The vulnerability originates in the kernel’s handling of page table entries for lazy‑freed folios. During batch unmapping, writable and non‑writable entries are mixed and the writable bit is not respected, which can cause the kernel to map an anonymous page as writable into multiple process page tables. The resulting BUG_ON triggers an oops, bringing the system down and rendering services unavailable.

All Linux kernels compiled from source code that lacks the recent commit fixing this logic are affected. The CVE record lists only the generic Linux kernel, so any distribution using the default 64‑bit 5.x or 6.x series prior to the patch is susceptible, particularly if large anonymous pages and MADV_DONTFORK, MADV_DOFORK or MADV_FREE are used on memory regions that contain a mix of writable and non‑writable pages.

The bug can be triggered locally by an unprivileged user following the supplied reproducer: allocate a 64K large page, split its VMA, fork, merge, mark the page as lazy‑free, dirty the page and finally trigger reclamation. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, but the crash that results is a deterministic failure of the kernel. Successful exploitation leads to an oops and a system reboot, without any documented path to privilege escalation beyond the loss of service.