The vulnerability occurs in the Linux kernel memory hotplug subsystem when the altmap argument is incorrectly passed as NULL in an error path of create_altmaps_and_memory_blocks(). This causes the vmemmap pages to be freed into the system buddy allocator instead of the intended altmap. Upon the subsequent arch_remove_memory() call, the physical linear mapping for the memory is destroyed, leaving unowned pages in the allocator. These pages can later be re‑allocated and used, resulting in machine checks or memory corruption. The failure to provide the correct altmap therefore grants the kernel the ability to inject corrupted pages, potentially destabilizing the system.

All Linux kernels that implement the memory hotplug functions referenced in the CVE (create_altmaps_and_memory_blocks(), arch_add_memory(), create_memory_block_devices(), arch_remove_memory()) and that have not yet incorporated the patch are potentially affected. The CPE entry indicates the vulnerability applies to the generic Linux kernel, so all distributions using a recent kernel build that includes this code path and does not contain the fix are susceptible. Precision on affected kernel versions is not provided, so consider your kernel version and whether the memory hotplug path exists.

The CVSS base score is 5.5, indicating moderate severity. The EPSS score of less than 1% shows a very low probability of exploitation. The CVE is not listed in the CISA KEV catalog. Attackers would need to trigger a memory hotplug operation, which typically requires privileged (root) access or kernel module activity. Because the corruption occurs in the kernel allocator, a successful exploit could result in kernel crashes or erratic system behavior rather than arbitrary code execution. The overall risk to an unpatched system remains moderate, but the impact can be severe if the machine crashes or becomes unreliable.