The vulnerability arises from an ABBA lock ordering violation in the OCFS2 module of the Linux kernel. When the unlink operation and the dio_end_io_write routine run concurrently, they acquire the orphan directory inode lock and the ip_alloc_sem semaphore in opposite orders, creating a deadlock that can halt the kernel. This flaw is classified as CWE-833 and CWE-667.

All Linux kernel builds that include the OCFS2 filesystem are potentially affected. Because the CVE description does not list specific release numbers, any system running OCFS2 prior to the fix is vulnerable. The risk applies to environments that use OCFS2 for clustered file storage, regardless of distribution.

The CVSS score of 7.5 indicates a high severity. The EPSS score is below 1%, and the vulnerability is not listed in CISA KEV. Based on the description, the deadlock can be triggered by local file operations that perform a delete and a write at the same time, requiring the attacker to have sufficient file permissions on the OCFS2 filesystem. A successful exploit would result in a kernel deadlock that effectively denies service until the system is rebooted.