The flaw lies in the Linux kernel’s virtual memory management module. Two code paths can trigger decay_va_pool_node() at the same time: lazy purging of vmap areas and the shrinker’s vmap node scan. Because this function is not re‑entrant, concurrent execution can corrupt internal data structures and leave memory leaks that grow the kernel address space, potentially crashing or destabilising the system. The vulnerability is a race condition and improper synchronization problem.

All Linux kernel builds that ship the vmalloc subsystem are impacted, as the advisory does not list particular kernel versions. The issue is introduced in the core kernel code, so any distribution using the affected linux_kernel is subject to the race until the commit that adds vmap_purge_lock in the shrinker path is merged.

The CVSS score is 7.8, and the EPSS score is < 1%. Additionally, the vulnerability is not present in CISA’s KEV catalog. The available information suggests that exploitation would require code that can trigger the concurrent paths inside the kernel, which typically implies privileged local access. Thus the threat is primarily a local‑privilege or compromised‑local‑code scenario that could lead to denial of service via a memory leak. No remote exploitation vector is documented in the description.