An integer overflow during the calculation of nr_pages in the Linux kernel’s filemap_map_pages() function causes the kernel to map past the boundary of a large folio. This overflow can corrupt page metadata such as mapcount and trigger kernel BUGs that appear as “Bad page state” crashes. The vulnerability is triggered during normal file mapping operations and can lead to kernel instability or denial of service.

The flaw affects the Linux kernel across multiple versions, including the 6.12 series and all 7.0‑rc releases up to rc7 as indicated by the CPE list. The issue has been reproduced on Arm64 machines using the 7.0‑rc3 kernel, but any kernel build that has not been patched for this commit is potentially vulnerable.

The CVSS score of 7.8 classifies the vulnerability as high severity. The EPSS score of <1% indicates a very low probability of exploitation in the wild, and the flaw is not listed in CISA’s KEV catalog. The attack vector is likely local or requires a process with privileges that can perform the file mapping operation that triggers the overflow. Because the bug leads to memory corruption, an attacker who can invoke the vulnerable path may be able to cause a kernel crash or, depending on context, use it to gain local privileges.