The flaw lies in the RADOS Block Device (RBD) subsystem of the Linux kernel, where a TOCTOU race is introduced between the cancellation and re‑queueing of the exclusive‑lock work item (lock_dwork). When a device is unmapped, the code assumes that the lock work has already finished, but the race can allow lock_dwork to run after rbd_dev_device_release() has freed critical kernel structures. This leads to memory corruption and an assertion failure in rbd_dev_header_info(), potentially causing a kernel panic or other severe corruption. The weakness is identified as CWE‑367.

All Linux kernel builds that include the RBD subsystem are potentially affected until the patch (commit 3427d7ae from the stable branch) is applied. No specific version range is supplied in the CNA data; therefore, any kernel with RBD enabled is at risk.

With a CVSS score of 7.8 the severity is high, yet the EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability requires local or privileged interaction with RBD I/O and unmap operations, making reliable exploitation challenging. It is not listed in the CISA KEV catalog, implying no publicly known exploits. Nevertheless, because a kernel crash can be catastrophic, the risk warrants prompt remediation.