The vulnerability resides in the GFS2 file‑system logic of the Linux kernel. During a fiemap request, gfs2_fiemap() calls iomap_fiemap() while still holding the inode glock. If the fiemap buffer is memory mapped to the same inode and a page fault occurs, the function attempts to acquire the same glock again, leading to a recursive lock acquisition that can deadlock the kernel. This defect is cataloged under CWE‑764 (synchronization flaw) and also listed as CWE‑401 (memory management flaw). The outcome is a complete system hang or the necessity to reboot, constituting an availability impact.

The flaw affects all Linux kernel releases that include the unpatched GFS2 implementation. Because the vulnerability is tied to the kernel’s handling of GFS2 fiemap operations, any distribution using a kernel that has not yet incorporated the fix is at risk. Specific kernel versions are not enumerated in the advisory, so administrators should treat all kernels prior to the patched release as vulnerable.

The CVSS score is 5.5 and the EPSS score indicates a very low exploitation probability (< 1%). The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be local: a user or process with the ability to perform a fiemap operation on a GFS2 inode that is memory‑mapped. There is no documented remote or privilege‑escalation vector. The primary risk is a local denial‑of‑service that can render the system unresponsive, potentially impacting critical services.