The vulnerability is a race condition in the Linux kernel’s fuse-uring subsystem. Concurrent execution of a ring registration and a connection abortion can cause the unmount thread to wait forever, leading to an indefinite hang and leaking internal structures. The flaw results in a denial‑of‑service scenario but does not directly provide code execution or data exfiltration. The weakness can be classified as a race condition (CWE-362).

All Linux kernel versions using the fuse-uring implementation that contain the unpatched race, such as the pre‑pending commit 2cd9454. Affected vendors include those providing the standard Linux kernel. No specific version range is listed, so the flaw is present until the kernel is updated to include the fix.

The flaw does not carry a published CVSS score and its EPSS score is not available, though it is not listed in the CISA KEV catalog. The attack requires the ability to concurrently trigger a fuse ring registration and a connection abort, which is likely limited to privileged users or processes with direct access to the fuse interface. While not exploitable remotely, an attacker with sufficient local privileges could purposely use this race to cause the system to hang during unmount or shutdown, resulting in a denial‑of‑service.