The Linux kernel introduced a race condition between the enabling or disabling of SR‑IOV Virtual Functions (VFs) and PCI hotplug events. When a Physical Function (PF) is removed while SR‑IOV is enabled, the original fix that acquired the PCI rescan/remove lock caused a deadlock, halting device removal and potentially blocking related system functions. The vulnerability manifests as a deadlock rather than code execution or data leakage, but it can disrupt services that rely on the affected device.

Linux kernel versions that still contain the buggy SR‑IOV locking logic are affected. The specific kernel versions are not enumerated in the data, so it is impossible to list exact releases; a kernel that has not applied the patch that correctly moves the lock to sriov_numvfs_store() is vulnerable.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, implying that known exploits are not documented. Attackers would need local privileged access to trigger SR‑IOV configuration changes or initiate hotplug actions. The likely attack vector is therefore a local privilege escalation or administrative action rather than a remote exploit. Because the impact is a denial‑of‑service via deadlock, the risk is significant for systems that rely on continuous PCI device operation, but the overall external exploitability remains low.