A bug in the Linux kernel’s x86 alternatives patching routine can trigger an unconditional crash when vmalloc_to_page() fails to map suitable pages. The failure causes a BUG_ON that aborts the kernel, resulting in a system halt or reboot. This loss of kernel availability is the primary impact, allowing an attacker to disrupt system operations. The weakness is a missing error handling path for a fatal condition, which if triggered disables normal recovery.

Linux kernel distributions that include the x86 architecture; specifically the openSUSE Tumbleweed build 7.1.3-1-default shown in the advisory are affected. Any Linux system using a kernel version prior to the patch that introduces the exclusion against change_page_attr() is at risk.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploitation yet. The adverse effect is local to the kernel; an attacker would need the privilege to load a module or invoke a routine that triggers the race condition. The risk level is moderate: while exploitation could lead to a complete denial of service, no known remote attack vectors or exploit code exist at the time of this analysis. The severity score is not specified, so the overall risk assessment remains based on potential kernel crash.