The vulnerability arises when the x86 Change Page Attributes (CPA) mechanism collapses ranges of kernel page table entries into huge page entries. During this collapse the freed page tables are released without protecting them with the appropriate lock. If a kernel page table walker such as ptdump traverses these tables concurrently, a use‑after‑free is triggered. The flaw is exercised only when CPA_COLLAPSE is active, which occurs in set_memory_rox() called by execmem and BPF code that changes executable memory mappings. The result is a kernel memory corruption that could crash the system or be exploited to execute arbitrary code with kernel privileges.

All Linux kernel variants prior to the patch that incorporates commit 41d88484c71c. The vendor list is generic Linux kernel; no specific versions are enumerated in the input. Any kernel that includes the unprotected page table collapse logic is affected.

The flaw is a classic use‑after‑free and could allow a local attacker who can trigger set_memory_rox() (for example by loading a malicious BPF program or using execmem) to corrupt kernel memory. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Because the code runs in process context, the attack requires user‑space execution but privileges are typically elevated by kernel mechanisms such as BPF helper calls, therefore the risk is non‑trivial. Exploitation would likely involve a race condition between page table collapse and page table traversal, making the likelihood moderate in the absence of precise timing. The CVSS score is not supplied, but the presence of a UAF in the kernel typically translates to a high‑severity rating.