The Linux kernel tracing subsystem can deadlock during a CPU hotplug operation when a CPU is taken offline. The issue arises because the interface_lock mutex is acquired before the cpus_read_lock, which leads a thread to wait indefinitely after a cpu_die event. This lock ordering bug causes a kernel freeze and results in a denial‑of‑service condition that can halt all services running on the host.

The flaw is present in Linux kernels that include the tracing and osnoise components before the commit that reordered the lock acquisition. No specific version range is listed, so any system built from mainline sources prior to the patch may be vulnerable, regardless of distribution or vendor.

The EPSS score is < 1%, indicating a low exploitation probability. The CVSS score of 5.5 denotes a medium severity. Based on the description, it is inferred that the attacker must be able to trigger a CPU hotplug event, which typically requires authenticated local or remote control of the node. Because the deadlock occurs inside the kernel, the impact is strictly availability; a kernel panic or prolonged stall will stop all processes. The likelihood of exploitation depends on the environment and the frequency of hotplug events, but the absence of a publicly available exploit reduces the immediate risk. Administrators should evaluate whether their systems undergo CPU hotplug and consider the vulnerability’s severity when planning remediation.