The Linux ARM64 kernel incorrectly omitted a page table destructor when hot‑removed page tables were freed. Page tables were allotted constructors that altered internal page_type flags and incremented global counters, but the matching cleaner was never invoked. This mismatch produces ‘Bad page state’ warnings, corrupts page statistics, and can leak page‑table locks if certain compile options are enabled. The result is a kernel instability that can manifest as a panic or memory corruption during hot‑plug events.

The vulnerability affects ARM64 builds of the Linux kernel that run prior to version 6.17, specifically the page‑allocation code referenced in the commit history. Any system using those kernel releases on ARM64 that may perform hot‑plug memory operations is potentially impacted.

The vulnerability is not listed in CISA’s KEV catalog and the EPSS information is unavailable. While it does not provide immediate privilege escalation capabilities, a local attacker with the ability to trigger a hot‑plug event could force the system into a kernel panic or cause memory corruption, leading to denial of service. The attack vector is inferred to be local and privileged, relying on kernel hotspots triggered by memory configuration changes.