The vulnerability arises from incorrect handling of device‑private or exclusive page unmaps in the Linux kernel’s memory management subsystem. When a file‑backed virtual memory area contains a folio that passes the anonymous test, the unmap path mistakenly treats it as anonymous and triggers a warning. This results in noisy kernel log entries but does not compromise memory integrity, confidentiality, or availability. The flaw is an input‑validation defect classified as CWE‑480 and manifests only as spurious warnings during process teardown.

All Linux kernel releases built before the commit 2fff0cdd942261497fb8922a194b4da3315ae864 (or any subsequent commit that includes the fix) are affected. This includes any custom kernels that lack this patch. The issue is restricted to architectures and builds where the kernel includes the device‑private page handling code.

With a CVSS score of 5.5, the vulnerability is classified as medium severity. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need local privileged access or the ability to execute code that triggers device‑private page unmaps to observe the warning; no direct privilege escalation, data disclosure, or denial‑of‑service is afforded. The primary concern is kernel log noise, which can obscure other genuine errors.