The vulnerability resides in the Linux kernel’s device-mapper dm-raid target and is a deadlock (CWE-833). When a dm-raid array that has metadata devices suspended is removed, the dm-raid destructor calls md_stop(), which attempts to flush the write‑intent bitmap by writing to the suspended metadata sub‑devices. Because those devices cannot complete I/O while suspended, the flush operation blocks indefinitely, causing the kernel to hang and the system to become unresponsive. The flaw results in a local denial of service. It is inferred that the attacker must have local privileged access, as the teardown requires stopping or removing dm-raid arrays. The attack vector is not explicitly detailed in the advisory.

Any Linux kernel build that includes the device-mapper dm-raid target and uses dm-raid managed arrays with metadata devices is affected. The issue manifests when the array is torn down while its underlying metadata and data devices are in a suspended state. No specific kernel version is enumerated, so all versions that satisfy these conditions should be considered vulnerable until a patch is applied.

The CVSS score is 5.5 and the vulnerability is not listed in the CISA KEV catalog. The EPSS score of < 1% indicates a very low probability that attackers are actively exploiting this flaw, though the described conditions remain theoretically feasible. The attack requires understanding of dm‑raid array management and the ability to trigger the teardown sequence, which typically implies root or privileged access. Consequently, the risk is local only and limited to systems that use dm‑raid under conditions that allow the described suspend and removal sequence. Proper kernel updates or configuration changes mitigate the risk. The exact attack vector is not described, but the need for privileged operations implies local availability.