The flaw follows from a logic error in the Linux kernel’s VFIO migration state machine. vfio_mig_get_next_state() walks an internal table to find the first supported next state, but when it reaches a blocked transition encoded as VFIO_DEVICE_STATE_ERROR the skip loop fails to detect the sentinel and keeps iterating because the table entry for ERROR points back to ERROR. The loop never exits, holding the driver’s state mutex indefinitely. This spin can trigger a kernel soft lockup, and if the kernel is configured with softlockup_panic it will lead to a crash. The weakness is a classic logic flaw (CWE-835: Infinite Loop) that results in a denial‑of‑service condition affecting the entire system.

All Linux kernel releases prior to the commit that fixes the bug are vulnerable. The vulnerability resides in the core kernel, so any distribution or derivative shipping an unpatched kernel is at risk. No specific version numbers are supplied, so any kernel that has not incorporated the patch can be affected.

The vulnerability has a CVSS score of 5.5 and an EPSS score of <1 %, indicating a very low current exploitation probability. It is not listed in the CISA KEV catalog. Attacker would need the ability to trigger a blocked state transition in the VFIO state machine, which typically requires interaction with a VFIO device that is already loaded into the kernel. This interaction usually requires root privileges or a process running in a privileged namespace; based on the description it is inferred that these prerequisites are necessary. If met, the attacker can cause a kernel soft lockup or panic and achieve a system‑wide denial of service. The overall risk is moderate to high for privileged contexts but low for unprivileged users.