The vulnerability is a lock ordering defect in the Linux kernel's tiny SRCU subsystem. When call_srcu() is invoked while the process interrupt (pi) lock is held, srcu_gp_start_if_needed() schedules work that internally acquires the workqueue pool lock, creating an unsafe lock ordering that can trigger a lockdep warning, potentially leading to a deadlock or kernel panic. The patch also invokes irq_work_sync during cleanup of a srcu structure to prevent a use‑after‑free if a queued irq_work fires after cleanup begins.

All Linux kernel releases prior to the inclusion of commit a6fc88b22bc8d12ad52e8412c667ec0f5bf055af are affected. The vendor list indicates the entire Linux kernel line, and no specific version constraints are provided, so any kernel lacking the fix should be treated as vulnerable.

The CVSS score of 5.5 and EPSS score of < 1% indicate a moderate severity but a very low probability of exploitation. An attacker would need to execute kernel‑mode code that triggers the SRCU path while holding the pi lock, a scenario limited to privileged or internal kernel components. The absence of a KEV listing further suggests a low likelihood of exploitation in the wild. The primary risk is therefore a denial‑of‑service from kernel instability rather than privilege escalation or data breach.