In the Linux kernel, the Device Mapper (dm) driver lacks its own timeout handling and mistakenly relies on its slave devices. When the kernel’s fail‑io‑timeout mechanism injects an io-timeout-fail error, the dm request is leaked and never returned, causing the associated task to hang indefinitely. This leak can hold kernel workers for extended periods, disrupting services that depend on the affected devices and leading to a permanent hung state until the kernel recovers or the logic is removed.

All Linux kernel builds that include the faulty dm timeout logic before the patch was applied. The issue exists in kernel code used by distributions based on Linux 6.19 and earlier releases that have not yet incorporated the fix. Any system running an unpatched kernel is at risk.

The CVSS score is 5.5. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no known public exploitation. The flaw can be triggered by writing to /sys/class/block/dm-*/io-timeout-fail and configuring the debugfs entries for fail_io_timeout. Based on the description, it is inferred that an attacker would need root or sufficient privilege to perform these writes. A local attacker with such privileges could deliberately cause kernel tasks to block, resulting in a denial‑of‑service that affects all users of the interrupted device. Because the kernel never recovers the leaked request, the issue remains until the offending code is removed.