The vulnerability occurs when the Linux kernel attempts to free vmemmap pages using the pagetable_free() routine, which is intended for page tables. Because vmemmap pages are not compound pages the routine only frees the first page of each PMD-sized block, leaving the remaining pages allocated. This results in a kernel memory leak that can accumulate over time, depleting kernel memory and potentially destabilizing the system. The weakness is an improper use of built-in freeing functions, identified as CWE‑772. No remote code execution or privilege escalation is directly provided by the defect, but the memory leak can degrade system performance and reliability.

Linux kernel releases that do not incorporate commit bf9e4e30f353 (“x86/mm: use pagetable_free()”) are affected. Distributions whose kernel packages lack this commit, or whose kernels are older than that commit, remain vulnerable until the patch is applied. Updated kernels that include the patch, or those that have received the corresponding security update, have the issue resolved.

With a CVSS score of 5.5, the vulnerability is regarded as moderate in severity. The EPSS score of less than 1% indicates a low probability of active exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack scenario requires an attacker to trigger the faulty freeing path through local or privileged kernel activity; no remote exploitation path is described in the advisory.