The defect resides in the Linux kernel’s RAID5 driver where a missing bitmap synchronization check in the need_this_block() routine creates an uncontrolled loop. When a degraded array uses a logical llbitmap that is still unwritten, write operations force a flush that relies on the bitmap. The missing guard allows handle_stripe() to repeatedly call handle_stripe_fill() without ever advancing, triggering a self‑terminating loop that consumes kernel LRU resources and finally stalls all I/O for the device, effectively denying service.

This issue affects any Linux kernel build that includes RAID5 with llbitmap enabled and has not incorporated the upstream fix. The publicly available data does not list specific kernel release versions, so all affected deployments should audit their current kernel state for the missing bitmap guard.

The CVSS score of 5.5 labels it a moderate threat, while an EPSS of <1% indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker must be able to produce write traffic to a degraded RAID5 array—a capability generally limited to privileged or local users. By triggering the loop, the attacker can force the array into an infinite retry cycle, rendering the storage subsystem unusable until a reboot or repair is performed.