The vulnerability resides in the Linux kernel memory‑management subsystem. During a madvise cold or pageout walk, the code incorrectly treats device‑private page‑middle‑directory entries, causing a VM_BUG_ON assertion that crashes the kernel. As a result an attacker that can trigger the race described can bring the entire system down, denying all services on the machine.

The flaw affects all versions of the Linux kernel that have not included the patch in commit 5c0d7b658cda62cd17cb3652783386d5608030ef. It is exercised by GPU drivers that use heterogeneous memory management (HMM) and invoke madvise with MADV_COLD or MADV_PAGEOUT. The affected path requires local code execution and typically relies on a compromised or malicious driver.

No CVSS score or EPSS data is supplied, and the vulnerability is not listed in the CISA KEV catalog. The severity of a kernel panic is obvious, though exploitation is constrained by the need for a GPU‑driver race condition; an attacker would likely need privileged access or a compromised driver to trigger the fault. The risk remains high, but the attack vector is inferred to be local code execution via an HMM‑based GPU driver.