The Linux kernel’s EFI subsystem contains a defect in the reserve_unaccepted() function that miscalculates the size of the memory reservation for unaccepted memory tables. When the table’s starting physical address is not page-aligned, the function aligns the size but fails to account for the portion of the table that crosses into a subsequent page, leaving that region unreserved. This can result in the table being overwritten or inaccessible, which leads to a kernel panic during the accept_memory() phase, effectively denying service to the system.

All Linux kernel releases that have not incorporated the reserve_unaccepted() fix are vulnerable. No specific version range is enumerated in the advisory, so any kernel that invokes this code path before the patch is at risk.

The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, indicating that there are no publicly known exploits and the exploitation probability has not been quantified. The likely attack vector is local or privileged: it can be triggered during boot or by manipulating EFI memory configurations, such as when an Intel TDX virtual machine allocates memory greater than 64 GB. This inference is based on the description that the issue is observed when starting VMs with specific memory sizes and that the fault occurs during the acceptance of EFI memory tables.