The vulnerability results from an overly wide critical section that locks the offset field of a gpio_shared_entry during operations on a shared GPIO proxy. When the proxy’s parent is removed, this lock can block indefinitely, causing a deadlock in kernel threads. The resulting blockage can stall device functionality or bring the system to a halt, thereby compromising availability. The weakness is a concurrency error that manifests as a race condition leading to a deadlock.

All Linux kernel releases built before the inclusion of commit 710abda58055 are affected. The commit shortens the critical section to protect only the offset when it is being read. Systems running the mainline kernel or any derivative that has not incorporated this change remain vulnerable until they are updated to a version containing the fix.

The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of exploitation. However, the likely attack vector is a local user or process that triggers the removal of a shared GPIO proxy’s parent. If successful, the attacker could cause a denial of service by hanging kernel threads. The CVSS score of 5.5 indicates medium severity, and combined with the low EPSS score and lack of KEV listing, the risk of exploitation remains low, but the availability impact warrants prompt remediation.