The kernel function print_page_owner_memcg() reads the page->memcg_data field twice, first with a safe READ_ONCE() and then again without any locking. If a concurrently running thread frees or reallocates the page as a tail page or slab page between these reads, the second unsynchronized access can trigger VM_BUG_ON assertions in CONFIG_DEBUG_VM builds, causing the kernel to crash. The crash manifests as a kernel panic, leading the system to reboot or become unresponsive, which is effectively a denial of service for any user-space applications or services on the host.

All Linux kernel releases that compile the mm/page_owner subsystem are affected. The vulnerability exists in every build that contains print_page_owner_memcg(); however, a crash is only triggered on builds with CONFIG_DEBUG_VM=y, a configuration typically used for kernel debugging. The impact is present in both production and testing kernels if they exercise page free and reallocation paths that reach the unsynchronized read.

The EPSS score is listed as < 1%, indicating a low probability of exploitation at this time, and the vulnerability is not included in CISA’s KEV catalog. Based on the description, it is inferred that the attack requires direct manipulation of kernel memory management, meaning the attacker must run privileged code or obtain kernel‑level control. The likelihood of a practical exploit is therefore limited to local attackers with sufficient privileges; remote exploitation is not feasible without additional kernel vulnerabilities. The absence of a CVSS score in the data does not detract from the high impact of a kernel panic, which would cause immediate denial of service. The fix replaces the second non‑synchronized read with a consistent memcg_data snapshot, eliminating the race condition.