An oversight in the Linux kernel’s huge memory management permits a user to drop the UFFD_WP write‑protection flag from a device‑private huge page mapping during a PMD downgrade. When an mprotect call removes write protection from a THP that is managed by userfaultfd, the kernel fails to propagate the break‑on‑write flag, thereby bypassing the fault trap on swap‑in. This flaw effectively gives write access to memory regions that should remain protected, allowing a malicious actor to corrupt data or execute code in a kernel or privileged context.

The vulnerability affects all releases of the Linux kernel that contain the buggy algorithm in mm/huge_memory, specifically systems using device‑private huge pages (THPs). All vendor supplies of the Linux kernel (for example, Linux:Linux) are potentially affected, because the patch is applied at the core kernel level.

The flaw is local to systems that run code with the ability to invoke mprotect on device‑private THPs and to attach a userfaultfd to those pages. The EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited public exploitation data. If an attacker can reach the application’s memory space with sufficient privileges, however, the ability to remove write protection and bypass fault handling could provide a high‑impact arbitrary memory write. The CVSS score is 5.5, but the analysis indicates a serious potential for privilege elevation or kernel corruption if successfully leveraged.