The vulnerability arises from a bug in the Linux kernel’s hugetlb management where clearing the uffd-wp bit incorrectly advances a swap offset. This corruption can overwrite adjacent data structures, potentially allowing an attacker who can trigger a fork with an in-flight huge-page migration or poisoned page to manipulate kernel memory. The resulting memory corruption could lead to arbitrary code execution or privilege escalation within the local system. The weakness is a classic out‑of‑bounds write, where a pointer is moved incorrectly into swap payload fields. No userfaultfd is required; the flaw is triggered simply by a plain fork under the described conditions.

All Linux kernel versions that include the affected hugetlb code path, i.e. all officially supported releases prior to the commit that fixed the bug. The specific affected versions are not enumerated in the CVE data, so any kernel in use that has not incorporated the patch is at risk. Kernel builds that do not enable hugetlb features are not affected.

The CVE report does not list a CVSS score; thus the exact severity is not quantified. EPSS is not available, and the vulnerability is not in the CISA KEV catalog. Because the exploit requires a local process and the corruption path depends on internal kernel state, the likelihood of exploitation in the wild is modest but non‑negligible. An attacker who can execute code or perform privileged actions on the host can cause a fork operation with a migrating or poisoned huge page to corrupt kernel data, potentially enabling privilege escalation.