In the ARM64 Linux kernel, the routine that sets page‑table access flags incorrectly treats a no‑op when the cumulative view of a contiguous block matches the desired state. Because the kernel aggregates flags from all sub‑page table entries, an update to a sibling entry can make the target entry appear up‑to‑date, even though hardware still marks it as read‑only or missing the access‑flag bit. This misinterpretation causes the page‑table walker to fault repeatedly on the stale entry, trapping the processor in an endless fault loop. The result is a denial of service that occurs when a fault is triggered on an unchanged entry; it is unclear from the description whether elevated privileges are required or whether ordinary memory accesses, which inevitably lead to faults, will always trigger the issue—this is inferred.

All ARM64 Linux kernels that lack the patch and employ system memory‑management units (SMMUs) without hardware translation‑table‑walk unit support, or CPUs missing the DBM or HTTU features. The problem also applies to systems where the SMMU has HTTU disabled or the TCR is configured with HA/HD disabled. No specific kernel versions are listed in the advisory, so any kernel built before the commit series that implements the per‑sub‑PTE check is potentially vulnerable.

The CVSS score of 5.5 indicates moderate severity, and EPSS is 0.00018 (less than 0.02%), so the quantified exploitation probability is extremely low. The vulnerability is not in CISA’s KEV catalog, indicating no public exploitation evidence yet. Nevertheless, an attacker could trigger the fault loop by forcing a fault on a vulnerable entry, which can occur during ordinary operations. The likelihood of exploitation depends on the presence of the fragile configuration; if an attacker can cause a fault on such an entry, the device can be brought to a halted state.