The Linux kernel bug occurs when the MMU is disabled and the level for an S1 mapping is set to a negative sentinel value because the code mistakenly casts the signed value to an unsigned byte, taking only the lower two bits. This leads the TLB size calculation to return zero, so the kernel does not correctly invalidate or flush entries that should be removed. If a virtual machine continues to use a mapping that has not been properly invalidated, it could read or modify memory that should have been cleared, potentially allowing a guest to access kernel memory or to inject code. The weakness is rooted in incorrect handling of signed-to-unsigned conversion and lack of input validation.

This flaw is limited to the Linux kernel, affecting all builds that use the KVM arm64 implementation where the S1_MMU_DISABLED state is referenced. No specific kernel versions are listed, so all affected ARM64 KVM instances are potentially impacted until the kernel patch is applied.

The vulnerability's CVSS score is not supplied, and its EPSS score is unavailable, so the likelihood of exploitation cannot be quantified precisely. The flaw is not listed in the CISA KEV catalog, indicating that there is no known exploitation in the wild so far. However, the underlying logic error could be leveraged by a correctly composed attacker with kernel or hypervisor access, especially in multi-tenant environments where virtual machines share a processor. Once the logic bug is fixed, the exploit path disappears, but until then the risk remains a moderate to high concern for systems running unpatched ARM64 kernels.