Based on the description, it is inferred that the flaw manifests when functions such as call_srcu(), synchronize_srcu(), or synchronize_srcu_expedited() are invoked on a CPU that is not fully online, leading to a hang caused by attempting to run a workqueue handler on a non-existent or offline CPU. This flaw is associated with the weakness identified by CWE-821. The Linux kernel srcu mechanism was found to incorrectly queue workqueue handlers for CPUs that are not yet online, or for CPUs that will never be online, including imaginary CPUs not present in cpu_possible_mask. On s390 platforms, this improper invocation can cause the system to hang, effectively denying service to users and system processes.

Based on the information available, the vulnerability applies to Linux kernel builds that include the srcu structures impacted by this logic, before the commit that added a guard against queuing callbacks to never-online CPUs. Any distribution running a kernel version that predates the fix, regardless of the vendor, is susceptible. The issue is most pronounced on s390 hardware, where workqueue handlers cannot be scheduled on offline or imaginary CPUs.

Based on the data provided, the EPSS indicates a likelihood of exploitation lower than 1%. The vulnerability requires local code that exercises the SRCU path with non‑online CPUs; there are no publicly known remote exploits. Because it is not listed in the CISA KEV catalog and is restricted to specific CPU conditions, the overall risk to many deployments remains moderate, yet the potential consequence of a system‑wide hang warrants prompt attention. Additionally, the CVSS score is 5.5.