The vulnerability stems from the Linux memory manager incorrectly treating a device‑private page map entry as a huge page during the free operation. Because the routine checks the pmd_is_huge() flag before confirming that the page is present, a device‑private PMD can enter a code path that expects a present page and invoke operations such as pmd_folio() that are not valid for that entry. This logical error can trigger a kernel panic, resulting in a system reboot or loss of service. The weakness lies in an improper race condition between concurrent memory migration and the madvise free operation, which is a classic example of CWE‑362.

The affected code path exists in all Linux kernel releases that miss the patch commits 5e3026bf736498115884d6c7bd0308ba29e0474c or ce579dcf730ce5ed8043a5eeea18a3e6706a97e5. The vulnerability is located in the huge page handling logic (mm/huge_memory), so any system running a Linux kernel that supports the HugeTLB interface and the HMM GPU memory model is potentially vulnerable. Systems that use only ordinary pages or that do not enable HMM support are not impacted.

At the time of this analysis, no CVSS or EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, so a precise quantification of risk is not possible. The description indicates a race condition between an HMM‑based GPU driver and a user‑initiated madvise(MADV_FREE) that can lead to a kernel panic. The exploit appears to require precise timing between a memory migration to a device‑private entry and the free operation, which makes the attack non‑trivial but not impossible in a controlled environment. Based on the description, it is inferred that the vector could be limited to systems running an HMM‑enabled GPU driver and processes that can initiate large‑page free operations, suggesting that local privileged or root access is likely required to orchestrate the race. The impact, however, remains a denial‑of‑service.