The vulnerability arises from calling the page table lookup functions pte_pfn() and pte_dirty() on non‑present page table entries. During the migrate_vma_collect_pmd() path, these functions may be invoked on non‑present or device‑private entries, leading to undefined behaviour. The result can be a kernel panic or incorrect dirty folio accounting, which manifests as a system crash. The impact is therefore a denial of service that can affect all users of the machine.

Linux kernel implementations. The flaw exists in any kernel build that includes the migrate_vma_collect_pmd() path and does not guard calls to pte_pfn() and pte_dirty() with a pte_present() check.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the flaw requires executing kernel code that can trigger the undefined behaviour, it is realistically exploitable by a local attacker or a malicious device driver, potentially causing a crash and disrupting service.