This vulnerability arises when the Linux kernel’s HugeTLB page structures for gigantic boot memory are not initialized early enough. The missing initialization allows the later zone contiguity routine to observe partially constructed page structures, leading to an incorrect determination of memory zone contiguity. If additional checks, such as poisoned‑page validations, are triggered in that path, the kernel can panic during early boot. The immediate effect is a boot‑time failure that renders the system unusable until a reboot or repair is performed, representing a denial of service at start‑up.

All Linux kernel variants that lack the fix are affected, regardless of distribution vendor. The issue is within the core kernel, making it applicable to any system running an affected kernel version. Because no specific release numbers are indicated, you should review your kernel to confirm whether it incorporates the initialization fix to assess potential impact.

The kernel crash is a severe outcome, but the vulnerability is limited to the boot environment and requires physical or privileged access to modify boot parameters or the kernel image. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, indicating no public exploitation reports yet. However, the nature of the bug—improper initialization leading to a kernel panic—suggests a high intrinsic impact for systems that cannot be readily patched. The likely attack vector is an attacker with the ability to influence the system boot, such as a malicious bootloader or disk image, which could trigger the panic or indirectly destabilize the system.