The vulnerability arises from freeing reserved memory in the memblock layer before the memory map has finished initializing. This leads to a classic use‑after‑free condition that can corrupt kernel memory. The bug manifests as a warning when the kernel boot option nohz_full is used, but the underlying flaw is a classic UAF that could compromise kernel stability or be chained to gain privileges. The description does not explicitly state an attacker‑controlled trigger; it is inferred that the vulnerability could be triggered by enabling the nohz_full boot parameter, creating a potential local privilege escalation path if exploited.

All Linux kernel builds that lack the two specific commits containing the fix are potentially impacted. The articles state that the vulnerability is present when the kernel boots with nohz_full and does not apply after incorporating commits 59bd1d914bb5 and 7c2eee9c1367. Thus, any kernel version prior to the inclusion of those patches, regardless of release number, can be affected. Because the CNA lists only the generic Linux kernel, the impact extends to all Linux distributions that use an unpatched kernel.

No CVSS or EPSS score is available, and the vulnerability is not listed in CISA KEV catalog. The bug requires kernel execution context and is only triggered by the nohz_full boot parameter; therefore a local attacker who can modify boot configuration could potentially trigger the UAF. The likely attack vector is a local privilege escalation that would result in kernel corruption or panic. Although no publicly disclosed exploitation technique is currently available, the well‑known use‑after‑free weakness makes it a high potential risk for systems that run with the offending boot option.