A logic bug in the Linux kernel’s DRBD module can allow the kernel to crash during an active resynchronization of disk replicas. The issue originates when the code incorrectly handles a situation where a lock acquisition fails while holding the al_lock spinlock, causing a LOGIC BUG log message but the request is not aborted. This progresses to an attempt to release activity log references that were never granted, which triggers a BUG_ON and results in a kernel panic. The crash can also lead to incomplete resynchronization and data inconsistency if the affected extents were mid‑flight IO. The vulnerability therefore poses a confidentiality, integrity, and availability risk for systems using DRBD.

The flaw is present in all Linux kernel distributions that include the DRBD module, as indicated by the CPE entry for linux:linux_kernel. No specific kernel or DRBD version numbers are provided, meaning that any system deploying DRBD is potentially impacted. The problem is tied to the interaction of active resynchronization and application I/O on the kernel level.

The CVSS scores are not disclosed, but the EPSS score is reported to be less than 1%, suggesting a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the most probable attack vector is a local or privileged user triggering the failure during DRBD resynchronization. Compromise is unlikely without such privileged context, yet the impact of a kernel crash is critical. Attackers would need to induce specific timing conditions that cause the lock failure, a nontrivial task, which further lowers the overall exploitation risk.