The vulnerability arises from improper ordering of RCU calls in the kernel’s DRBD subsystem, specifically the drbd_adm_dump_devices() function invoking rcu_read_unlock() before rcu_read_lock(). The thread-safety analyzer flagged this mismatch, which can create a race condition that might corrupt shared data accessed during device dumps or cause other unexpected kernel behavior, though a crash is not explicitly documented.

All Linux kernel releases that include the DRBD subsystem with the unbalanced RCU calls in drbd_adm_dump_devices() are affected. This applies to every Linux kernel variant not yet updated to the patch that balances the RCU lock ordering.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of < 1% suggests that exploitation opportunities are currently rare. The vulnerability is a concurrency flaw that, based on the nature of the function, would likely require local privileged access to trigger the vulnerable routine. The vulnerability is not listed in CISA’s KEV catalog, and no evidence of a publicly available exploit has been reported.