The Linux kernel’s mm/shrinker module inadvertently acquires an RCU read lock around a callback that may sleep. This violates RCU’s lock‑free contract and triggers a BUG when the "count" debugfs file is read, potentially causing a kernel panic and taking the system offline. The issue is an improper synchronization flaw (CWE-663) that can lead to a local denial of service, as any process with access to the debugfs entry can trigger it.

All Linux kernel instances that include an unpatched mm/shrinker implementation, notably those with memcg‑aware shrinkers such as zswap, are susceptible. The issue applies to any distribution that ships the generic Linux kernel without the commit that removes the RCU lock in shrinker_debugfs_count_show(). Any user or process able to read the debugfs "count" file can trigger the flaw.

The CVSS score of 5.5 indicates moderate severity, while an EPSS value of less than 1% and absence from CISA’s KEV catalog suggest a low likelihood of exploitation. Nevertheless, the flaw requires local access with privileges sufficient to read debugfs; a root or privileged user can exercise the bug and cause a system crash. Since the attack vector is local and the kernel exposes the file only to privileged users, the risk to public-facing services is limited, but an administrator could use this vector to perform a denial‑of‑service attack.