A race condition in the Linux kernel device‑mapper function dm_blk_report_zones allows a device to be suspended after an unlock test is performed without holding a lock. The function checks the device state by calling dm_suspended_md, but this call occurs before dm_get_live_table is called and without synchronization. If the device is suspended immediately after the unsynchronized check, subsequent zone reporting may be performed on a suspended or stale device, potentially leading to malformed data or block operation failures. The CVE description does not indicate that a kernel panic is guaranteed, and no DoS behavior is explicitly documented.

All Linux kernel versions that contain dm_blk_report_zones without the recent commit that moves the dm_suspended_md check after dm_get_live_table are affected. This includes the upstream kernel and any distribution kernels that ship the same unpatched code. The common platform enumeration provided covers all Linux kernel releases.

The flaw is a local race condition that requires an attacker to trigger a device suspend during a narrow window of unsynchronized operation. It is not readily exploitable remotely and would most likely necessitate privileged or root access to manipulate block device operations. The CVSS score of 5.5 reflects moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local, with a requirement to control or influence the device‑mapper operation cycle.