The defect occurs in the Linux kernel's page_pool allocator, where the fragment size is rounded incorrectly on architectures with DMA alignment of 1. A caller requesting an odd‑sized fragment leaves the pool's frag_offset misaligned. Subsequent allocations from that shared pool produce fragments whose starting addresses are misaligned, causing cache‑line split lock violations in atomic operations. On x86 with split‑lock detection enabled the kernel panics with “Split lock detected” – a classic denial‑of‑service (DoS) that brings the entire system down.

Affected systems include all production releases of the Linux kernel that contain the buggy page_pool code, notably 6.12.101 and 7.1.8, on architectures where dma_get_cache_alignment() returns 1 (e.g., x86 desktop and server CPUs). The vulnerability is exercised by generic‑mode XDP programs bound to loopback and any user process that opens a raw UDP socket, which causes skb_pp_cow_data() to carve out odd‑size fragments repeatedly. The issue is not limited to the immediate caller; the shared pool means all consumers can suffer the panic.

The CVSS score is not disclosed, and the EPSS score is unavailable, but the CISA KEV database does not list this issue, indicating no widespread exploitation. Nevertheless, the exploit requires only the ability to send crafted raw packets or deploy a low‑privileged XDP program on the host, both of which are trivially achievable by an attacker with network access to the machine. Because the resulting crash is total, the risk is high and remediation should be treated as an urgent priority. The fix is to align frag_offset by rounding the requested size to dma_get_cache_alignment() or the required skb_shared_info alignment.