The Linux kernel contains an infinite loop in the rcu_read_unlock() routine that is triggered when a softirq is raised while ftrace is enabled. The removal of recursion‑protection code in __rcu_read_unlock() makes it possible for the loop to be entered during normal kernel operation. When the loop executes, the CPU cycles are consumed indefinitely, leading to a kernel freeze that renders the system unresponsive.

All Linux kernel builds that include the buggy __rcu_read_unlock() logic before the incorporation of commits 5f5fa7ea89dc and b41642c87716. This includes every distribution and custom kernel that has not applied these patches, because the flaw resides in core kernel code and is not limited to any optional module or configuration.

The CVSS score is 7.1, indicating a high severity vulnerability. The EPSS score is less than 1%, suggesting a low likelihood of exploitation. The flaw is not listed in CISA’s KEV catalog. Exploitation would require local kernel privileges or the ability to trigger a softirq with ftrace enabled. Consequently, the risk is moderate to high: systems where kernel code can be executed may suffer a denial‑of‑service attack by inducing the infinite loop, while systems lacking such privileges remain unaffected.