In Linux kernel versions with CONFIG_DEFERRED_STRUCT_PAGE_INIT and large CMA reservations, the function deferred_grow_zone() can incorrectly overflow the pgdat->first_deferred_pfn counter when the node’s RAM end is not aligned on PAGES_PER_SECTION boundaries. This overflow causes a subsequent BUG_ON in deferred_init_memmap() because the pointer references a pfn that lies outside the node. The resulting kernel panic is a local denial‑of‑service condition that stops system operation. The vulnerability is essentially an integer overflow bug that leads to memory corruption.

Affected systems are all Linux kernels running with CONFIG_DEFERRED_STRUCT_PAGE_INIT enabled and a sizeable CMA reservation, as demonstrated in kernel 7.2.0‑rc6. The bug exists in the core memory management code at mm/mm_init.c and will affect any node that has an unaligned RAM boundary when deferred struct pages are initialized before the node’s memory map is fully set up.

Based on the description, it is inferred that the defect triggers only during the kernel boot process when the overflow is reached. The CVSS and EPSS scores are not available and the vulnerability is not listed in CISA’s KEV catalog, so the public exploitation probability remains undefined. Based on the description, it is inferred that an attacker would need local privileged access to the machine or a way to influence kernel boot parameters, such as controlling the CMA reservation size, to trigger the fault. In practice, the risk manifests most readily as a local denial of service rather than arbitrary code execution.