The arm64 kernel function show_pte() walks page tables without proper locking and while interrupts are enabled. A concurrent teardown can free a table page that show_pte is accessing, or a parent table entry can be cleared after show_pte has checked it, allowing page‑table helpers to compute a bogus lower‑level pointer and trigger a fault. This race condition enables a use‑after‑free that can corrupt kernel memory, potentially allowing an attacker to subvert kernel integrity or execute privileged code.

All arm64 Linux kernel builds that include the vulnerable show_pte implementation are affected, regardless of version. The issue exists in any kernel that contains the original lockless page‑table walk logic; only builds that incorporate the post‑commit patch in the arm64/mm area are safe.

EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. There is no known public exploit, and the race condition requires a local situation where a process can trigger a page‑table teardown concurrently with a show_pte walk, which typically implies kernel‑mode or privileged execution. While the exploitation difficulty is uncertain, the potential for arbitrary kernel memory corruption makes the vulnerability high‑impact if successfully exploited. The absence of a malicious sample reduces the immediate threat, but the possibility of privilege escalation remains.