A race condition exists in the Linux kernel's io_uring/poll implementation. When a socket is sent to and immediately shut down, two wake‑ups occur before the receiver task can process them. The first wake acquires poll ownership, the second increments it, and when the poll loop checks for events it processes only one receive and then exits, discarding the shutdown event. As no further wake‑ups will happen, the multishot receive loop can hang indefinitely, effectively blocking the application or service that relies on the socket. This results in a denial of service condition for the affected process.

The flaw affects all Linux kernel distributions. Any system running a kernel that includes the io_uring/poll code without the applied fix is vulnerable. The precise kernel versions are not enumerated in the data, so all recent releases prior to the fix are considered at risk.

The vulnerability is a concurrency race that can lead to a complete service blockage. No publicly disclosed exploit path is provided, and the EPSS score is unavailable; however, the nature of the defect means that any code using multishot io_uring poll operations could be impacted. The CISA KEV catalog does not list it, which suggests it may not yet have been widely exploited. Nonetheless, the potential for a denial of service in a kernel context warrants immediate attention.