During the memfd_luo memory retrieval cleanup path, the kernel function kho_restore_folio() expects a physical address value, yet it receives a raw page frame number (PFN). Because of this mismatch, the subsequent kho_restore_page() call computes an incorrect physical address by shifting the PFN instead of using the actual physical address. This logic flaw, combined with the omission of a guard that checks for a zero PFN in sparse file holes, means the kernel might process invalid memory references or attempt to restore pages that do not exist. If an attacker can trigger this code path, they could cause memory corruption or a crash, leading to loss of data integrity or a denial of service.

The bug resides in the Linux kernel’s memory handling layer. All systems running the vanilla Linux kernel or derivatives that include the unmodified memfd_luo implementation are affected. The data set does not enumerate specific kernel version numbers, so any build that has not yet been updated with the patch that corrects the PFN-to-physical address conversion is vulnerable.

While CVSS and EPSS metrics are unavailable and the vulnerability is not listed in CISA's KEV catalog, the flaw touches low‑level kernel memory management. Exploitation would likely require local privilege or a prior vulnerability that grants kernel‑mode execution. Because the bug can introduce memory corruption or a panic, its severity could be high if an attacker can exercise the affected code path. Administrators should treat this as a priority update, given the potential impact on system stability and data integrity.