In the Linux kernel, the migrate_vma_insert_huge_pmd_page function leaks a page table when it aborts due to a PMD consistency failure: the page table allocated earlier with pte_alloc_one is never released. This defect accumulates kernel memory over time, eventually exhausting kernel memory credits and degrading system stability. The result is a gradual denial‑of‑service condition stemming from depleted memory resources, identified as CWE‑772.

All Linux kernel builds compiled before the fixes introduced in commits 24861d04f197bb651e9dfb211978271c15f75a98 and 2c6f81d58741349298f51ff697d988cb42881453 are vulnerable. Because the affected code resides in the core mm subsystem, the issue is present across all distributions and kernel versions that have not incorporated the patch. Any system running a kernel derived from the upstream source prior to these commits inherits the vulnerability.

The EPSS score is reported as less than 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of active exploitation in the wild. Based on the description, it is inferred that an attacker would need to trigger the vulnerable VMA migration path, which typically demands kernel or root privileges. If such an attacker succeeds, repeated failures would drain kernel memory, potentially leading to a crash or forced reboot. Because the exploitation path requires privileged execution, the risk is primarily limited to local users or compromised privileged processes, but the fault should still be regarded as a medium‑to‑high impact resource exhaustion risk in environments with heavy kernel memory usage.