The vulnerability originates in the Linux kernel's DRBD subsystem, where drbd_adm_dump_devices() incorrectly orders RCU lock operations, calling rcu_read_unlock() before acquiring rcu_read_lock(). This race condition can corrupt shared data accessed during device dumps and may cause a kernel panic, resulting in a denial‑of‑service. The defect was identified by Clang's thread‑safety analyzer and reflects a concurrency flaw that could be leveraged by an attacker with the ability to trigger the dump routine or invoke the vulnerable function while the kernel is running.

All Linux kernel implementations are affected as the generic Linux kernel CPE (cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*) indicates no version restrictions. The flaw exists in any kernel build that still contains the unbalanced RCU calls in drbd_adm_dump_devices() until the patch is applied.

There is no CVSS score in the provided data, and the EPSS score is not available, so the exploitation probability cannot be quantified precisely. The vulnerability is not listed in CISA's KEV catalog. The defect is a race condition that can lead to a denial‑of‑service by crashing the kernel. Based on the description, it is inferred that exploiting the vulnerability would require local privileged access to execute drbd_adm_dump_devices(). This suggests the risk is significant for systems that run the DRBD subsystem and allow the dump function to be invoked by privileged users.