The kernel may leave certain struct page objects uninitialized when DAX memory is introduced into a boot‑time unoptimized ZONE_DEVICE subsection. The omitted tail pages remain unset, so later accesses can trigger undefined behavior or crash the system, resulting in a loss of availability without affecting data confidentiality or integrity.

Any Linux kernel build that supports hot‑plugging of DAX memory into early ZONE_DEVICE sections before the patch is applied is vulnerable. All kernel versions prior to the commit that added the fix (identified by the commit hash 11f2826e9ee6f24aaa774e3dcd75abbe4b3091b6) are affected.

With a CVSS score of 7.8 the flaw is classified as high severity. The EPSS score is below 1 %, indicating a low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog and no known exploits exist. The likely attack vector requires privileged access to initiate DAX hot‑plugging or to execute code within the kernel, which is inferred from the need to modify memory map structures. Without such privilege, exploitation is unlikely.