The flaw lies in the Linux kernel’s llbitmap architecture. A barrier is raised after the llbitmap_state_machine() routine runs in llbitmap_start_write() and llbitmap_start_discard(). If the state machine finishes before the barrier is in place, concurrent operations may interleave in an unsafe way, potentially corrupting kernel data structures or triggering a kernel panic. The weakness is a race condition that can expose the system to memory corruption or denial of service if an attacker can manipulate the sequence of calls.

The vulnerability affects the Linux operating system, specifically the kernel component. No particular kernel version ranges are listed as vulnerable; however, kernels that do not contain the commit that moves the barrier raise earlier (cited as 9142f00a9287ca38152717e3e88a033a27774e7f) are considered not vulnerable. Administrators should verify that their running kernel includes the commit or a later stable release that incorporates the defensive change.

The CVSS score of 5.5 indicates a moderate severity, while the EPSS score of < 1% represents a very low likelihood of exploitation. The issue is not listed in the CISA KEV catalog. Because the race can be triggered through local interactions, a privileged local attacker could exploit the flaw to corrupt kernel memory or cause a denial‑of‑service condition. Overall, the risk remains moderate, with exploitation expected to require local or elevated privileges and a carefully timed race condition.