The vulnerability arises from a race condition between the ptdump page‑table walker and the vmalloc huge‑promotion logic in the Linux kernel. When vmalloc promotes a small page table to a huge leaf entry, it frees the small page table without holding the init_mm mmap lock. If ptdump is walking the same ranges concurrently, it can observe a freed page table and attempt to de‑reference it, resulting in a use‑after‑free that can corrupt kernel memory. This bug is an example of the classic "Use‑after‑free" weakness (CWE‑825) and can be used to read or write arbitrary kernel memory, potentially leading to kernel privilege escalation. The trigger requires concurrent ptdump activity and vmalloc huge promotion, so an attacker would need to induce the race in a scenario where both operations interact.

All Linux kernel builds that include the vmap huge‑promotion logic and have not applied the patch series "mm: fix UAF caused by race between ptdump and vmap pgtable freeing" (v6) are affected. This includes x86, arm64, and other architectures that use the same vmalloc implementation. The CPE for the affected product is linux_kernel for all platforms; no narrow version range is provided, so every kernel prior to the patch is considered vulnerable.

The flaw is a kernel‑level memory corruption bug with medium severity, reflected in its CVSS score of 7.0. Because it allows arbitrary writes to kernel memory, an attacker could achieve full privilege escalation. The attack vector is most likely local, as ptdump is normally a root‑only interface; however, if a local attacker can trigger a ptdump or otherwise manipulate kernel memory, exploitation becomes feasible. The EPSS score is < 1% and the flaw is not listed in CISA KEV, but the absence of these metrics does not reduce the inherent risk. In practice, applying the patch is the only reliable mitigation; other defensive actions are not supported by the CVE data.