During early boot, the kernel uses per‑zone shared tail pages that are not yet initialized when CONFIG_DEBUG_VM is enabled. The uninitialized pointer is dereferenced, resulting in a null‑pointer panic before the system can finish booting. The bug does not expose data or execute code; it simply stops the kernel from starting, producing a denial‑of‑service for the affected host.

All Linux kernels compiled with CONFIG_DEBUG_VM that employ HugeTLB or device DAX for memory management are vulnerable. The issue appears on any distribution using an unpatched kernel that follows the fix series "mm: Refactor bootmem gigantic hugepage allocation" (v4).

The vulnerability manifests only during system boot and no public exploits have been reported. It is not listed in CISA KEV. Because the failure occurs before the operating system is fully operational, the threat is limited to interruption of service. However, in environments requiring constant availability, repeated reboot attempts or uncontrolled power cycling could exacerbate the impact until the firmware or bootloader is updated with a patched kernel configuration.