A concurrency bug in the Linux kernel’s memory migration path allows a destination page to be made visible before it is correctly re‑queued on the deferred split queue. The race can trigger WARN messages in deferred_split_folio() and may silently discard fully mapped, under‑used pages, potentially causing kernel memory corruption or loss of pages. The flaw is a classic race condition (CWE‑362) involving improper synchronization between migration and split queue handling, and it also exemplifies a lost updates race (CWE‑367).

All Linux kernel releases that do not include commit 3bac01168982ec3e3bf87efdc1807c7933590a85 (or later) are affected. This affects every Linux distribution that ships a kernel prior to that commit, regardless of vendor or distribution name.

The CVSS score is 7.0 and the EPSS value is unavailable; the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation would require a local or privileged context, but the CVE data does not explicitly state the required privilege level. Although it may be difficult to leverage remotely, systems that cannot upgrade may face a moderate to high risk of instability or memory corruption if the race is triggered.