snapshot_page() in the Linux kernel reads the __page_2 pointer after checking that the number of pages is greater than one. When an order‑1 folio is allocated at the end of a vmemmap section, the __page_2 entry does not exist, and the code sequence attempts to read a non‑existent page, causing a fault and an oops. The resulting kernel crash leads to a loss of service for the entire system in the affected process context. The flaw is a classic out‑of‑bounds read that can be triggered when memory hot‑plug operations, such as DLPAR removal, exercise code paths that traverse the snapshot_page() function.

The vulnerability affects all Linux kernel releases that include the unchanged snapshot_page() implementation prior to the patch commit that corrects the bounds check. Because the issue manifests during DLPAR memory removal on a 22 TB ppc64le LPAR, all systems running the unpatched kernel on supported architectures (e.g., x86_64, ppc64le, etc.) are susceptible. Any distribution’s kernel that did not apply the upstream patch is at risk until an updated kernel image is deployed.

The CVSS score is not provided, and the EPSS score is unavailable, so a precise risk quantification is not possible. The flaw is listed as not included in CISA’s KEV catalog, indicating that it has not been observed in the wild as of the last known data. Nevertheless, the defect can be exercised via privileged memory‑removal operations that trigger snapshot_page() on a vmemmap hole, which could be used to cause an unintended system crash. Attackers would need the ability to perform DLPAR or equivalent hot‑plug actions, a privilege that is typically protected by system administrators. The overall threat is therefore a potential local or privileged denial of service.