The ARM64 Linux kernel omitted the complimentary pagetable_*_ctor calls and page freeing leads to "Bad page state" warnings, corrupts page statistics, and may leak PT‑lock table allocations. The flaw is a clear instance of CWE‑459 improper deallocation of a freed resource, potentially resulting in kernel instability or memory corruption during hot‑plug memory events.

The vulnerability affects ARM64 builds of the Linux kernel running versions prior to 6.17, specifically when the DEBUG_VM debugging feature is enabled. Any system performing hot‑plug memory operations on these kernels is potentially impacted. The effect is limited to the kernel’s memory management subsystem and does not directly affect user‑space data or privileges.

The CVE is not listed in CISA’s KEV catalog and its EPSS score is reported as less than 1%, implying a very low but non‑zero exploitation probability. A local attacker with privileged access could trigger a hot‑plug event that forces the system into a kernel panic or memory corruption, resulting in denial of service. The likely attack vector and required privilege level are inferred from the description of hot‑plug memory handling and are not explicitly stated in the CVE data.