The vulnerability occurs when the Linux kernel performs a memory hot‑remove on a RISC‑V platform. The remove_pud_mapping() and remove_p4d_mapping() routines incorrectly calculate page‑table indices when page‑table levels are folded at runtime. The calculation can walk past the parent table and reference a page that is unrelated to the memory being removed. This results in the kernel triggering a BUG in mm.h through __free_pages(), producing an unhandled VM_BUG_ON_PAGE, and ultimately causing a kernel panic. The primary impact is a local denial‑of‑service attack that brings the entire system down to a crash state, as the kernel aborts execution.

Any Linux kernel running on RISC‑V architectures is potentially affected, as the flaw is part of the generic mm implementation that applies to all RISC‑V builds. No specific kernel version range is provided in the advisory, so the vulnerability may exist in all releases that include the cited unpatched code until the patch is applied.

The CVSS score of 5.5 indicates a medium severity vulnerability, but the risk remains high because the flaw leads to a forced kernel crash. The advisory lists an EPSS score of <1% (approximately 0.00168), indicating a very low exploitation probability, yet the likelihood of exploitation is considered non‑negligible given the ease of triggering hot‑remove on systems that support dynamic memory changes. The vulnerability is not listed in the CISA KEV catalog. Attackers would need local or root privileges to execute memory hot‑remove or could abuse a privileged user’s ability to unload kernel modules that perform such operations.