The Linux kernel's page_ext iteration API lacked validation to ensure that the page frame number (PFN) being accessed still belonged to a valid memory section during iteration. Specifically, when memory is dynamically added via hotplug, the iterator could advance past the last valid PFN, causing page_ext_lookup to dereference a NULL pointer. This occurs because for_each_page_ext() macro increments the iterator beyond the valid range, triggering a NULL pointer dereference at the boundary of the last valid memory section. The vulnerability was fixed by moving the iteration boundary enforcement inside the iterator functions, preventing callers from accessing beyond the requested range.

This vulnerability can cause a NULL pointer dereference in the Linux kernel during memory hotplug operations, leading to kernel crashes or denial of service. There is no indication of code execution or privilege escalation from the provided data. The impact is limited to system stability during dynamic memory addition.

A fix has been implemented in the Linux kernel that enforces iteration boundaries within the page_ext iterator functions, preventing invalid PFN access. Users should apply the official kernel updates that include this patch to mitigate the issue. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or kernel maintainers' advisories for the current remediation guidance and apply updates accordingly.