The flaw stems from incorrectly using the pmd_write() helper on a softleaf PMD entry during the migration path. In this situation, the helper misinterprets the soft‑dirty flag as a writable bit, causing the kernel to install a PMD entry that is marked writable when it should be read‑only. The resulting inconsistent rmap state leads to an improper flag handling issue, and in the described test scenario an assertion is triggered, evidencing memory corruption in the kernel's page mapping data structures.

All Linux kernel releases that contain the buggy code path – specifically those that include commit 65edfda6f3f2 and have not been backpatched with the later fix commit 775465fd26a3 – are affected. This encompasses the upstream kernel versions listed in the CPE data, including the 7.1 release candidates up to rc7, as well as any distribution kernels released before the patch was applied.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% denotes a low likelihood of exploitation. The flaw is not presently listed in the CISA KEV catalog, suggesting no known active exploitation. Attack conditions appear to require a locally privileged user who can trigger device‑private huge page migration, such as through the kernel’s test infrastructure or by allocating device‑private THPs and manipulating migration flags. No evidence indicates that remote exploitation is feasible without such local control. The overall risk remains moderate with a low probability of exploitation in typical environments.