Large io_uring read operations on the /dev/msr* device cause io_wq workers to spend an excessive amount of time processing data. The kernel then reports a hung task after approximately 140 seconds, which can stall process shutdown and potentially impact system responsiveness. The flaw does not provide arbitrary code execution but can exhaust kernel resources and generate availability issues. This is the primary impact of the vulnerability.

All Linux kernel releases prior to the patch that include the io_uring infrastructure are affected, notably kernel 5.12 and the 6.19 series, including all release candidates. Any system that runs these kernels and exposes the io_uring interface is susceptible.

The CVSS score of 5.5 reflects a moderate risk, while the EPSS score of less than 1% indicates that exploitation is unlikely but possible. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could trigger the condition by sending large io_uring read requests to /dev/msr* devices, which requires the target to have the privilege to issue such requests. The exploitation route would therefore involve privileged or compromised processes rather than remote unauthenticated access.