The Linux kernel contains a flaw in its memory compaction code where the function free_pages_prepare() can fail, but the compaction_free() routine does not handle the error condition. When a page fails preparation, it may be either hardware poisoned (PageHWPoison) or deemed bad by free_page_is_bad(). The faulty logic still adds such pages back into the freepages list, which can later be allocated for write operations. If a bad page is reused, it can overwrite valid data or propagate corrupted data, resulting in data integrity failures. This weakness stems from improper handling of error return values in kernel internal memory management, a flaw that may cause data corruption.

The vulnerability applies to the Linux kernel as a whole. All kernel releases that include the unpatched compaction_free() logic are potentially affected. The fix is included in the kernel commits referenced in the advisory and is available in recent kernel releases; older releases that have not incorporated those commits would remain vulnerable.

The EPSS score is reported as < 1% and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 7.8 indicates a moderate severity. The flaw involves internal memory handling, so an attacker would likely need local or kernel-level access to reliably trigger free_pages_prepare() failures and force the bad pages back into use. With no public exploit documented, the potential for data corruption makes this weakness a low to medium risk pending a formal severity rating.