A race condition exists in the Device Mapper cache policy in the Linux kernel, where an allocation check for a cache entry is performed outside the mutex that protects the deletion of that entry. If two invalidators run concurrently, they can both observe the entry as allocated, proceed to delete it, and free it again. This can corrupt SMQ queues or hash tables, and may lead to kernel memory corruption that can cause system crashes, kernel panics, or compromise availability of the system.

All Linux kernel releases that implement the Device Mapper cache with the SMQ queue are affected. The vulnerability impacts any kernel that does not contain commit 2d1f7b65f5de or later. Affected CPEs include the generic Linux kernel and specific releases such as 5.10.258, 5.15.209, 6.1.175, and 7.1 rc1 through rc6.

With a CVSS score of 7.8 and an EPSS score of less than 1%, the vulnerability is considered high severity but the probability of exploitation remains low. The race condition requires two concurrent cache invalidations which could be triggered by multi‑threaded workloads or by administrative access to device‑mapper mappings. The likely attack vector is local and requires privileged execution to initiate the concurrent invalidations. Because it is a local kernel race, an attacker must have local access or be able to run privileged code that exercises the Device Mapper cache. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed public exploits as of the latest data.