A recursive locking issue is described in the Linux kernel’s SCSI target configuration path. The problem arises when a file write operation triggers a sequence that re‑acquires a semaphore it already holds, potentially leading to a recursive lock. The description notes a "possibility of recursive locking," and it is inferred that if this occurs the system could lock up and become unavailable, resulting in a denial of service.

All Linux kernel builds that include the SCSI target (target_core) module before the patch is merged are affected. The CVE does not provide a specific version range, so any kernel lacking the change that replaces a filp_open with kern_path in target_core_item_dbroot_store is at risk.

The CVSS score of 5.5 indicates a medium severity vulnerability, while the EPSS score of less than 1% suggests a low probability of active exploitation. The issue is limited to local interaction with the /sys/kernel/config/target filesystem, so the likely attack vector is local privileged file manipulation or kernel access. The vulnerability does not provide remote code execution or privilege escalation, and the CVE is not listed in the CISA KEV catalog.