The vulnerability arises when the ARM64 Linux kernel fails to handle invalid large leaf page‑table entries correctly. When such entries are cleared—as occurs for secret memory, kfence and realm DMA regions—code paths that assume a valid mapping fault, producing a kernel panic. The flaw is a privilege‑management defect (CWE‑372) that disrupts system availability and could allow an attacker to force a reboot if the fault can be triggered during operation.

All ARM64 Linux kernels that lack the commit a166563e7ec37, which introduced proper handling for large leaf mappings. Systems running kernel releases prior to 7.0.0‑rc4, or any distribution whose kernel package has not been updated with the patch, are affected.

The CVSS score is 7.5, denoting high severity, but the EPSS score is <1%, indicating a low probability of real‑world exploitation. The vulnerability is not listed in CISA KEV, suggesting limited attacker interest. Based on the description, exploitation would likely require local access to trigger the invalid mapping during a memory‑mapping operation. The primary risk is availability loss rather than remote code execution.