The flaw, characterized by CWE-825, is in the Linux kernel’s handling of large page splits on x86. When a large page is split, the kernel allocates a new page-table entry directly, bypassing the normal page-table allocation API. Because the page-table constructor is never invoked, the resulting page table is not marked as a kernel page table, so the IOTLB cache is not invalidated when the split page table is freed. This can leave stale IOTLB entries that may reference invalid memory, potentially causing memory corruption or a crash.

All Linux kernels that include the x86/mm/pat code path and contain commit 5ba2f0a15564 or later— that is, every distribution using a kernel version where deferred freeing of kernel page tables was introduced and where large pages may be split during normal operation. The issue applies regardless of distribution, configuration, or whether direct map page tables are used.

A CVSS score of 8.2 indicates high severity, but the EPSS score is less than 1%, so the likelihood of exploitation is low. The vulnerability is not listed in CISA's KEV catalog, meaning no known active attacks. Based on the description, it is inferred that exploiting this vulnerability would require kernel‑level privileges or the ability to trigger a large‑page split, after which stale IOTLB entries could be used to corrupt memory or crash the kernel. Due to the high impact if successfully exploited, users should treat this as a priority to patch.