The flaw lies in how the RISC‑V Linux kernel calculates the base address of the virtual memory map (vmemmap_start_pfn). It rounds the physical RAM base address down using a physical address alignment constant that was expressed in bytes of page storage, not in the physical‑address domain. When the resulting address does not satisfy the required MEMMAP alignment, the sparse memory allocator may log a warning and the kernel can crash during boot, causing a denial of service. This bug is therefore a memory‑management flaw that can lead to a kernel panic and service interruption.

All RISC‑V implementations of the Linux kernel that contain the misaligned alignment logic—namely any kernel built without the fixed version that applies the physical‑address alignment for vmemmap_start_pfn. No specific kernel versions are listed, so the issue applies to current builds that have not incorporated the upstream commit.

The CVSS score is not listed and the EPSS score is unavailable, but the vulnerability can trigger an early kernel panic, producing a denial of service. It is inferred that the attack vector would be internal to kernel initialization and would require privileged kernel execution or a misconfigured boot image, as the fault occurs during boot. Because it occurs during boot, remote exploitation is unlikely, but systems that boot with an unaligned DRAM base (e.g., some QEMU configurations) are vulnerable. The vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploit at this time.