The Linux kernel includes a race condition in the device‑mapper function dm_blk_report_zones. The function calls dm_suspended_md to test whether a device is suspended, but this check occurs without holding the appropriate locks and before the live table is locked. If an attacker suspends the device immediately after the unsynchronized test, subsequent zone reporting may operate on a device whose state has changed, potentially leading to malformed data or block‑device operation failures. The weakness is a classic timing race, classified as CWE‑367, and does not directly trigger a kernel panic or system crash according to the description.

All Linux kernel versions that contain the unpatched dm_blk_report_zones logic are affected. The fix moves the dm_suspended_md call after dm_get_live_table to introduce proper synchronization. Distribution kernels that ship identical code without the commit are also vulnerable; the common platform enumeration cpe:2.3:o:linux:linux_kernel:* covers all kernel releases.

The flaw is a local race condition that requires the attacker to trigger a device suspend during a narrow window of unsynchronized execution. It is unlikely to be exploited remotely and would typically require privileged or root access to influence block‑device operations. The CVSS score of 7.8 indicates moderate to high severity, the EPSS score of less than 1% shows a very low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is local with a prerequisite of controlling or interacting with the device‑mapper subsystem.