The vulnerability involves a deadlock in the Linux kernel’s ext4 journaling path, specifically in the function jbd2_journal_cancel_revoke(), and represents CWE‑833 (Abnormal Lock Ordering). The lock ordering conflict between folio and buffer locks triggers an ABBA deadlock when the filesystem blocksize is smaller than the page size, which can cause system hangs or a generic kernel panic. The resulting denial of service allows a misbehaving user to force the entire system to become unresponsive or require a reboot.

All Linux kernel builds that include ext4 and use the jbd2 journaling code are affected. The issue existed in kernels before commit f76d4c28a46a, which replaced the unsafe lock handling with a safer implementation. Distributions shipping kernels that do not include this commit are at risk.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is not available and it is not listed in the CISA KEV catalog. The deadlock is triggered by an internal execution path that requires local access to perform certain filesystem operations involving jbd2_journal_cancel_revoke(), such as creating or modifying directories. Exploitation would likely lead to a local denial‑of‑service rather than remote code execution.