A bug in the Linux kernel’s x86 alternatives patching routine can trigger an unconditional crash when vmalloc_to_page() fails to map suitable pages. The failure causes a BUG_ON that aborts the kernel, resulting in a system halt or reboot. This loss of kernel availability is the primary impact, allowing an attacker to disrupt system operations. The weakness is a missing error handling path for a fatal condition, which if triggered disables normal recovery.

Linux kernel distributions that include the x86 architecture; specifically the openSUSE Tumbleweed build 7.1.3-1-default shown in the advisory are affected. Any Linux system using a kernel version prior to the patch that introduces the exclusion against change_page_attr() is at risk.

The EPSS score is <1% and the vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploitation. The CVSS score of 5.5 reflects a moderate impact. The adverse effect is local to the kernel; an attacker would need privilege to load a module or trigger the race condition that causes vmalloc_to_page() to fail and lead to a BUG_ON. The risk level is moderate: while exploitation could lead to a complete denial of service by crashing the kernel, no remote attack vectors or exploit code are known at the time of this analysis.