The vulnerability arises from an improper use of phys_to_virt to map Hyper‑V page buffer entries that reference high‑memory pages on 32‑bit x86 systems with CONFIG_HIGHMEM. When a packet containing a skb fragment points to a high‑memory page, phys_to_virt returns an address outside the direct map. Subsequent memcpy on that address faults on the transmit softirq path, causing a kernel panic. The bug does not enable arbitrary code execution but leads to a local or remote service disruption, as a single packet that triggers the fault will crash the host kernel. The weakness can be classified as a memory‑access error that results in kernel panic.

The issue affects Linux kernel builds that provide the hv_netvsc driver for Hyper‑V virtual network interfaces. Systems running a 32‑bit x86 kernel with CONFIG_HIGHMEM enabled and transmitting packets that include skb fragments are susceptible. The patch addresses the page mapping logic for all architectures that support Hyper‑V, including arm64, but the failure scenario is most common on x86 with high‑memory pages.

The CVSS score of 7.5 indicates high severity, while the EPSS score is less than 1%, suggesting a very low exploitation probability at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog. An attacker can trigger the failure by sending a packet over the Hyper‑V netvsc interface that contains a skb fragment referencing a high‑memory page; the copy path is used for packets smaller than the default send‑section size of 6144 bytes. The resulting memcpy fault causes a kernel panic, leading to denial of service. The impact remains limited to the affected host, and no remote code execution is possible.