The vulnerability is a race condition in the Linux kernel’s damon_hugetlb_mkold() routine. When the kernel clears and restores a page table entry for a huge page, concurrent hardware updates to the same entry can be overwritten. The immediate effect is that hardware‑set dirty or accessed bits may be lost, leading to inconsistent page state and potentially delayed or missing writes back to storage. No crash or direct data disclosure occurs as described in the CVE data.

All Linux kernel versions that implement damon_hugetlb_mkold() without the patch listed in the advisory are affected. This includes kernels from all manufacturers that ship this code path; any distribution kernel prior to a fix commit, regardless of version, remains vulnerable.

The CVSS score of 1.9 indicates a low severity flaw. The EPSS score is less than 1 %, suggesting a very low likelihood of exploitation. The flaw is not listed in CISA KEV. Exploitation would require kernel‑mode access and would affect only operations involving huge pages; no known attack vectors from user space are documented. Overall risk is considered low.