The Linux kernel’s handling of the shadow stack during a sigreturn contains a lock ordering bug that can lead to a deadlock. When the kernel attempts to read a shadow stack frame and the access faults, the fault handler may recursively acquire the mmap read lock, while another CPU may be holding an mmap write lock. This mismatch follows the concurrency race pattern identified as CWE‑667 and can cause a deadlock that stalls the kernel’s ability to handle signals, effectively disrupting normal operation. The concurrency error results in denial of service and potentially affects overall system availability.

All Linux kernels compiled for x86 with the shadow stack (X86_USER_SHADOW_STACK) enabled and running on SMP machines are affected. The issue is tied to the PER_VMA_LOCK configuration, which is the default for SMP kernels. Specific kernel versions are not listed, but any build that includes the code paths described in the advisory is potentially vulnerable.

The CVSS score is 5.5, indicating a moderate severity, and the EPSS score is 0.00094 (<1%), indicating a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the flaw manifests during normal signal handling, so exploitation likely requires triggering a sigreturn in a context where a page fault occurs, which typically demands local or privileged code execution. Based on the description, it is inferred that even when triggered, the impact is local denial of service through a kernel deadlock rather than remote code execution. The bug presents as a classic concurrency race (CWE‑667) and does not provide a direct code execution path.