The kernel’s huge memory handling code fails to initialise a critical field during folio splitting. This results in an uninitialised xa_state that, when the kernel later walks the memory reclamation list, triggers a VM_WARN_ON that can abort or crash the kernel. The weakness is an improper initialization flaw (CWE-665). The crash forces a system reboot or kernel panic, causing a denial of service.

All Linux kernel releases may be potentially affected. The advisory does not provide specific version ranges, so administrators should verify whether their kernel contains the fix for the huge memory subsystem. Kernels that have not incorporated this change remain vulnerable.

Both the CVSS and EPSS metrics are unavailable, so the likelihood of exploitation cannot be quantified. Based on the description, it is inferred that a local attacker, potentially operating within a privileged container or with root access, who can influence memory allocation patterns or memory cgroup limits, may trigger the bug by forcing the kernel to split folios. Successful exploitation will lead to a kernel panic or abrupt reboot, resulting in denial of service. The vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploits yet, but the high severity warrants rapid mitigation.