The Linux kernel has a flaw in the mm component where zap_pte_range calls a TLB flush routine with an address that is always one page past the end of the range being freed. This incorrect address results in the flushing of the wrong paging-structure cache entries, leaving stale references to an empty page table. On some CPUs, a later access to these stale references can fault, potentially causing the kernel to panic or crash. The weakness does not lead directly to arbitrary code execution, but can lead to denial of service by destabilizing the kernel.

All Linux kernel versions that contain the unpatched zap_pte_range logic are affected. The vulnerability is present across all architectures supported by the kernel until the commits referenced in the advisory are incorporated. Distributions shipping the vulnerable kernel are impacted until an update that includes the patch is installed. The CPE entry indicates the entire kernel stack is covered.

The CVSS score of 7.8 denotes high severity, while the EPSS score of less than 1% signals a low probability of exploitation in the wild. Based on the description, it is inferred that an attacker would need local or privileged access to trigger the page-table reclamation path and provoke the fault; the flaw is not remotely exploitable. No publicly known exploit exists, and the vulnerability is not listed in CISA KEV. However, successful exploitation would lead to a kernel crash and effectively cause a denial of service on the affected system.