A race condition exists in the Linux kernel when a huge page is split and a migration entry is accessed simultaneously by the zap_nonpresent_ptes() function. The split operation locks the folio, sets page flags, and then releases the lock after several stages. However, softleaf_to_folio() lacks a required smp_rmb() read‑memory barrier, so the migration entry can be read before the tail page’s flags, including PG_locked, are fully visible. This can cause the kernel to process a folio that is not truly locked, triggering VM_WARN_ON_ONCE or a BUG_ON in pfn_swap_entry_folio(). The resulting kernel data corruption leads to possible system crashes or loss of integrity. The CVSS base score is 4.7, indicating a medium severity, and the EPSS score is below 1%, implying a low likelihood of exploitation in the wild.

The issue affects all Linux kernel releases prior to the inclusion of commit 93976a20345b, which was merged in kernel v6.19‑rc1. Any system running an earlier kernel that uses the described MTHP split and zap_nonpresent_ptes pathways is vulnerable.

This concurrency flaw requires a multi‑core environment where huge‑page splitting and memory eviction race conditions can occur. Exploitation demands privileged kernel access and precise timing, making successful attacks unlikely. The vulnerability’s CVSS base score is 4.7, placing it in the medium severity range, and its EPSS score is below 1%, indicating a low likelihood of exploitation in the wild. The absence from the CISA KEV catalog further reduces risk. Nevertheless, if successfully exploited, an attacker could induce memory corruption or a kernel panic, compromising system integrity.