The flaw resides in the Linux kernel’s scsi_run_host_queues function, which fails to process devices that are in a partially removed state such as SDEV_CANCEL. This oversight causes requeued SCSI commands for those devices to never be re‑enqueued, making the device removal operation stall and preventing the kernel from progressing past the recovery state. The weakness is a classic example of CWE‑772: missing release of resource after reuse, where the state transition of a device is mishandled, leading to a resource (the command queue) that cannot be completed. As a result, the SCSI subsystem can become unresponsive, effectively producing a denial of service within the host system. Because the kernel must be privileged to perform SCSI operations, an attacker would need local or elevated access to trigger a recovery situation and attempt device removal; the resulting hang is confined to the affected host.

All Linux systems that include the unpatched Linux kernel code are impacted, regardless of distribution. The CNA list identifies the defect as a kernel‑wide issue, and no specific version string is supplied, so any kernel revision prior to the patch release should be treated as vulnerable.

The CVSS score of 7.5 labels the vulnerability as high severity, yet the EPSS score of less than 1% indicates that, at present, exploitation is unlikely. The flaw is not listed in the CISA KEV catalog, and because it requires local privileged code to induce the recovery state, the attack surface is relatively narrow. However, the DoS effect can be critical for systems that rely on timely SCSI device removal.