snapshot_page() continues to read the __page_2 pointer after verifying that nr_pages > 1. When an order‑1 folio is allocated at the boundary of a vmemmap section, the __page_2 entry does not exist. The code dereferences the nonexistent pointer, triggering a fault and an oops that brings down the kernel. The resulting crash represents a denial of service, as the system becomes unusable for all users and services.

All Linux kernel builds that have not incorporated the upstream fix remain susceptible. The issue manifested during a DLPAR memory removal on a 22‑TB ppc64le LPAR, so any deployment that utilizes large memory pools or performs hot‑plug memory operations—especially on power‑pc64 architectures—is at risk unless the kernel has been updated.

The CVSS base score of 7.1 classifies the flaw as high severity. The EPSS score of < 1 % and the absence from the CISA KEV catalog suggest a low exploitation probability. The likely attack vector is a privileged attacker who can initiate a memory hot‑plug operation; based on the description, it is inferred that triggering snapshot_page() during a DLPAR memory remove can exploit the defect. If an attacker obtains kernel‑level privileges, they could force the kernel to crash, resulting in a denial‑of‑service condition for the system.