The flaw originates from the ordering of page_ext initialization during Linux kernel boot. Pages that are allocated and freed before page_ext is fully initialized retain an uninitialized codetag, which KASAN later reports as a warning when the pages are freed. The weakness does not provide a direct exploitation path; it chiefly undermines kernel debugging and can lead to excessive KASAN output or, in worst cases, destabilization of kernel memory tracking.

The problem occurs in Linux kernel builds that enable memory allocation profiling with CONFIG_MEM_ALLOC_PROFILING_DEBUG set to Y and the mem_profiling_compressed option left disabled. While the core kernel code is part of the Linux project, the visible warnings appear primarily in debug or development builds where allocation profiling is turned on. Production kernel configurations with allocation profiling turned off are not directly impacted by the observed warnings.

The CVSS score is not publicly available, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The flaw requires a specific configuration (CONFIG_MEM_ALLOC_PROFILING_DEBUG set to Y and mem_profiling_compressed disabled) and only manifests during early boot, limiting the attack surface. Remote attackers would need to alter kernel configuration or the boot process, making exploitation unlikely. The risk is considered low; administrators should monitor KASAN logs and apply the upstream patch when available.