The vulnerability arises from an improper use of phys_to_virt to map Hyper‑V page buffer entries that reference high‑memory pages on 32‑bit x86 systems with CONFIG_HIGHMEM. When a packet containing a skb fragment points to a high‑memory page, phys_to_virt returns an address outside the direct map. Subsequent memcpy on that address faults on the transmit softirq path, causing a kernel panic. The bug does not enable arbitrary code execution but leads to a local or remote service disruption, as a single packet that triggers the fault will crash the host kernel. The weakness can be classified as a memory‑access error that results in kernel panic.

The issue affects Linux kernel builds that provide the hv_netvsc driver for Hyper‑V virtual network interfaces. Systems running a 32‑bit x86 kernel with CONFIG_HIGHMEM enabled and transmitting packets that include skb fragments are susceptible. The patch addresses the page mapping logic for all architectures that support Hyper‑V, including arm64, but the failure scenario is most common on x86 with high‑memory pages.

The CVSS score is not provided, and EPSS is not available, so the precise exploitation probability cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog. The attack requires that the victim host receives a network packet over the Hyper‑V netvsc interface that contains a fragment referencing a high‑memory page exceeding the send‑section size of 6144 bytes. An attacker who can force such traffic will cause a kernel panic, resulting in a denial of service. The impact is limited to the affected host; no remote code execution is possible.