The Linux kernel contains a flaw in the block layer where the function bdev_mark_dead() incorrectly calls sync_blockdev() when a device is removed in surprise mode. This unconditional sync waits indefinitely on writeback that can never complete, causing the reset worker to hang and any tasks waiting on it to block. The issue does not corrupt memory or grant privileged access; it simply renders the system unresponsive when a surprise removal occurs, such as during an NVMe reset.

All Linux kernel builds from the core distribution that have not yet incorporated the recent patch to bdev_mark_dead() are vulnerable. The flaw is present in the generic Linux kernel regardless of vendor or distribution, so any system using an unpatched kernel version prior to the fix can be affected.

The EPSS score is below 1%, indicating a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. With a CVSS score of 5.5, the flaw is assessed as medium severity, meaning it could allow a local or privileged attacker to cause a denial‑of‑service by triggering a surprise block‑device removal, such as an NVMe reset. The attack requires a path to invoke the bdev_mark_dead() function with surprise==true, typically by initiating an NVMe reset or other device wipe operation. Once triggered, the kernel will hang while waiting on writeback, causing a system‑wide block and unresponsiveness.