The vulnerability originates in the x86 Change Page Attributes mechanism where page tables are collapsed into huge entries without holding the appropriate lock. This releases page tables that may still be referenced by page‑table walkers such as ptdump, leading to a use‑after‑free in kernel memory. Based on the description, it is inferred that an unintended memory corruption could occur, potentially resulting in a kernel‑space fault; the extent to which this could enable privilege escalation is not explicitly documented.

Affected systems include all Linux kernel releases that incorporate the unprotected CPA collapse logic before the patch that adds commit 41d88484c71c. The flaw is triggered by set_memory_rox(), which is used by execmem and BPF when adjusting executable memory mappings. Therefore any working kernel that supports those subsystems and does not include the commit is susceptible.

The CVSS score of 7.0 indicates high severity, while the EPSS score of less than 1 % suggests low probability of exploitation in the wild. The vulnerability is not in the CISA KEV catalog. Exploitation would likely require a local user to invoke set_memory_rox(), potentially through a malicious BPF program or execmem usage, and to trigger a race condition where page‑table collapse occurs concurrently with a walker. Based on the description, it is inferred that an attacker would need to time the collapse and walk to cause the use‑after‑free, making the attack non‑trivial but possible.