In the Linux kernel, handling of device‑private PMD entries was incomplete. The page_vma_mapped_walk routine failed to call check_pmd and misinterpreted PVMW_MIGRATION flags, leading to memory corruption when a device‑private entry was treated as a migration entry. This flaw can corrupt arbitrary kernel memory and provides a local attacker with the potential to gain elevated privileges or crash the system.

All Linux kernel versions prior to the inclusion of the commits 65edfda6f3f2 and 146287290023 are affected. This includes a wide range of distributions that have not yet applied the patch, as the vulnerability exists in the core memory management subsystem.

The flaw presents a moderate to high exploitation risk due to the memory corruption it can cause. While no public exploit is recorded and EPSS is unavailable, the intrinsic severity of writing incorrect data in kernel space could lead to remote code execution if an attacker can influence the conditions that trigger the faulty code. The lack of a current listing in the CISA KEV catalog indicates no known widespread exploitation, but administrators should treat the issue with urgency.