The vulnerability resides in the Linux kernel’s memory mapping subsystem: the loop variable nr_pages is not re‑initialized at the start of each iteration of try_to_unmap_one, allowing a value computed by a prior folio_unmap_pte_batch() call to be mistakenly reused. When the kernel subsequently processes a device‑exclusive page, this stale nr_pages value can corrupt folio reference or map counters, which leads to a crash. The bug is exposed by mapping a 64 KiB anonymous region with MAP_DROPPABLE, advising MADV_FREE, marking the last page device‑exclusive, and then triggering node reclaim via sysfs.

All Linux kernel builds that include the mm/rmap code path are affected. This spans the generic Linux product across all supported architectures. Systems running an unpatched kernel are vulnerable until a patch is applied.

The CVSS score is 7.8, indicating a high severity vulnerability. The EPSS score of less than 1 % shows a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a complex, multi‑step memory‑mapping sequence and the activation of node reclaim, which limits the attack surface to a local context with significant technical effort. Successful execution would result in kernel crashes, leading to a denial of service for affected processes or the entire system.