A race exists between page‑table attribute updates and CPA collapse in the Linux kernel. When an attribute change occurs, a lockless walker obtains a PTE that can later be freed by a concurrent CPA collapse before it is overwritten. This results in a use‑after‑free that corrupts kernel memory, matching CWE‑825. The official description does not claim that the flaw leads directly to code execution or privilege escalation, but it can destabilize or crash the system.

All Linux kernel implementations that predate the commit inserting an init_mm read lock during attribute changes are affected. No precise version range is listed, so any kernel built prior to that change should be considered vulnerable.

The CVSS score is 7.0 and the EPSS score is less than 1%. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local race between attribute changes and CPA collapse. The likely attack vector is local, as the description implies the attacker must trigger both operations concurrently; this inference is based on the absence of an explicitly stated vector in the payload.