The vulnerability is a SOFTIRQ‑unsafe lock order that can cause a deadlock between tasklist_lock and other locks when send_sigio or send_sigurg are invoked from softirq context. A process group with FASYNC enabled can be forced into a self‑inflicted deadlock when an urgent TCP packet or an input event triggers signal delivery. The resulting deadlock stalls kernel progress, effectively bringing the system to a halt and allowing an attacker to cause a denial of service.

All Linux kernel builds that include the tasklist_lock read_lock in send_sigio or send_sigurg and do not yet apply the patch that replaces it with rcu_read_lock. The affected vendors are the Linux kernel maintainers; no specific distribution version is listed in the supplied data.

There is no CVSS or EPSS score available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector requires an external user able to send or influence TCP URG packets or trigger fasync input events. If successful, the attacker can induce a kernel‑level deadlock that hangs the entire system, causing a denial of service. The likelihood of exploitation in the wild is currently unknown; the lack of exploitability data suggests it is not widely exploited yet but the potential impact is high for affected hosts.