Secretmem pages are treated as if they were mlocked by the kernel, but the folios remain unevictable and their unevictable state is not cleared on unmapping. Mapping and then unmapping a secretmem region does not enforce the RLIMIT_MEMLOCK limit, and the folios are not accounted for in the process RSS. A user can repeatedly map and unmap secretmem, causing all available system memory to be consumed with unevictable folios while the OOM killer remains unaware, potentially leading to system instability.

All Linux kernel installations that include the secretmem feature are affected, regardless of distribution. The vulnerability exists in any kernel version where secretmem tracks folios as mlocked without removing the unevictable flag on unmapping. No specific vendor or version was noted, so any platform deploying a Linux kernel with secretmem support could be impacted.

No CVSS score is supplied, EPSS is unavailable, and the issue is not listed in the CISA KEV catalog. The attack surface is local; a user capable of creating or accessing a secretmem file descriptor can leverage the flaw by performing repeated map/unmap cycles. Because the memory cannot be reclaimed and remains unseen by the OOM killer, the exploitation can lead to denial of service at the system level. The likelihood of exploitation is moderate: it requires the attacker to locate a secretmem region, but once discovered the impact is severe.