A circular locking dependency exists in the RDS TCP implementation of the Linux kernel; the function sk_net_refcnt_upgrade() performs memory allocation while holding the socket lock, creating a situation where the task can be stalled by another lock, leading to deadlock. This weakness aligns with CWE‑833 and also demonstrates characteristics of CWE‑667, a race condition that can cause inconsistent state or deadlock. The flaw can lead to a denial‑of‑service if the lock order is repeatedly violated.

All Linux kernel distributions before the commit that introduced the lock fix are affected. The issue has been reported for both the generic Linux kernel and the Linux kernel for Linux-based systems. No specific version range is listed, so any kernel version that has not yet merged the patch is vulnerable.

The vulnerability carries a CVSS score of 7.5, indicating a high severity level. The estimated probability of exploitation is less than 1 percent, and it is not currently listed in CISA KEV. The attack vector is inferred to require traffic that triggers rds_tcp_tune, limiting exposure to environments where the RDS protocol is active. The flaw primarily threatens availability, potentially leading to blocking of RDS connections or a kernel-level deadlock that can disable network services.