The Linux kernel vulnerability originates in the vmalloc sub‑system when CONFIG_PAGE_OWNER is enabled. During vmalloc cleanup, freeing KASAN shadow pages triggers repeated stack unwinding that acquires RCU read locks. Because the cleanup loop does not voluntarily schedule, a single task can hold the CPU for many seconds while sequentially processing hundreds or thousands of vmap_area entries. This creates an unbounded RCU critical section, causes rcu_preempt stall messages, and can lead to out‑of‑memory conditions by preventing other tasks from completing RCU grace periods. The primary impact is a denial of service that manifests as kernel stalls and potentially system unresponsiveness.

All Linux kernel releases that compile with CONFIG_PAGE_OWNER enabled and that include the KASAN shadow page tracking feature are affected. The flaw is present in the kernel code before the recent patch that introduces periodic cond_resched() calls in kasan_release_vmalloc_node. Systems running any kernel prior to that patch and with the relevant configuration in use face the risk.

The CVSS score of 5.5 indicates medium severity. The EPSS score is < 1%, implying a low likelihood of exploitation under current threat landscapes, and the vulnerability is not listed in CISA KEV. It is a local kernel bug; an attacker must trigger a large vmalloc cleanup, which typically requires running privileged or kernel‑mode code. The description does not mention any publicly disclosed exploits, so no known exploitation techniques are available. Based on the description, it is inferred that an attacker would need kernel‑level execution or a configuration that generates a large cleanup to exercise the flaw.