A flaw in the Linux kernel's sched/mmcid code causes an infinite loop when a vfork()‑ed task is scheduled. The logic that counts vfork() tasks mistakenly stops the walk when the counted tasks exceed the number of MMCID users, leaving the task's CID unassigned. Once this occurs, subsequent scheduling attempts cannot acquire a transitional CID and the kernel stalls, resulting in a system freeze and loss of service availability.

The vulnerability affects all Linux kernel releases that include the buggy sched/mmcid implementation and have not yet incorporated the patch found in the linked commits. No specific version numbers are provided, so any current kernel variant lacking these changes could be vulnerable. The impact is limited to Linux systems, irrespective of distribution, as it resides in the core kernel.

The CVSS score is 5.5 and EPSS is < 1%, indicating a very low probability of exploitation. Despite this, a kernel stall can halt services and impair availability. It is inferred that exploitation would likely require local privileged execution, such as a process that uses vfork() with CLONE_VM, and the vulnerability is not listed in the CISA KEV catalog. Until the kernel is patched, the risk remains non‑negligible but not imminent.