The vulnerability stems from a race condition in the Linux kernel’s SCSI core that can prevent the error handler from being woken after the final command completes or times out. The issue arises from improper memory ordering between marking commands as complete or failed, causing the host busy count and failed count to become unsynchronized. As a result, SCSI host I/O operations can remain indefinitely stalled, effectively denying service on affected devices.

All Linux kernel builds that include the resident SCSI core implementation are susceptible, including the 6.19 release candidates (rc1 through rc6) and presumably later stable releases until the bug is patched. The problem is present in the core kernel, affecting any system that relies on SCSI host functionality.

Based on the description, it is inferred that the attack vector is a race condition exploited during concurrent SCSI I/O commands. Exploitation would require precise timing of multiple concurrent SCSI commands and likely local or privileged access to the affected system. The CVSS score of 4.7 indicates a moderate severity. The EPSS score is below 1%, suggesting a very low likelihood of imminent exploitation, and the vulnerability is not listed in the CISA KEV catalog. While remote exploitation is improbable, an attacker with sufficient privileges could potentially abuse the race to render a device non‑functional. The main vector is race condition exploitation within kernel space during normal I/O operations.