In the Linux kernel, the Device Mapper (dm) driver lacks its own timeout handling and mistakenly relies on its slave devices. When the kernel’s fail‑io‑timeout mechanism injects an io-timeout-fail error, the dm request is leaked and never returned, causing the associated task to hang indefinitely. This can lead to a permanent hung state for kernel workers and potentially disrupt services that depend on the affected devices. The vulnerability is a classic denial‑of‑service condition triggered by a request leak caused by improper timeout handling.

All Linux kernel builds that include the faulty dm timeout logic, before the patch that removes the blk_should_fake_timeout check was applied. The issue is present in the kernel code used by distributions based on Linux 6.19 and earlier releases that have not yet incorporated the fix. Users of any distribution running a kernel that has not been patched are therefore at risk.

The CVSS score and EPSS value are not available in the current record, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly documented exploitation at this time. However, the flaw can be triggered by writing to /sys/class/block/dm-*/io-timeout-fail and configuring the debug interface, which requires root or sufficient privilege. An attacker with local privilege can deliberately cause tasks to block, leading to a denial‑of‑service that affects all users of the interrupted device. The lack of a timeout handler means the kernel can never recover the leaked request, making the issue persistent until the kernel is updated or the faulty logic is removed.