A missing guard in the function that sets the write‑protect flag on a HugeTLB page table entry can lead to a race where the hardware updates Dirty or Accessed bits between a read of the page table entry and a commit that writes a stale snapshot back. The result is corruption of the kernel’s knowledge of huge‑page usage and can cause subtle memory state inconsistencies or failures in programs that depend on accurate huge‑page metadata.

All Linux kernel releases that have not yet incorporated the six fixes from the userfaultfd/pagemap series are affected. The specific version range is not enumerated, so any kernel running before the patches were applied—whether mainline or distribution‑maintained—remains vulnerable.

The CVSS score of 7.1 indicates moderate‑to‑high severity. The EPSS score of less than 1 % shows a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, the race condition requires a local or privileged attacker to manipulate userfaultfd protection settings on HugeTLB pages, and could enable memory corruption that might lead to privilege escalation or system instability. The overall risk is moderate while the exploitation window is currently small.