The vulnerability arises from a recursive locking deadlock in the Linux audit subsystem when duplicate executable rules are handled during file moves. The deadlock occurs when audit_dupe_exe() calls audit_alloc_mark(), which in turn attempts to acquire a directory lock already held by the task, leading to a blind recursion that blocks progress. The result is a denial of service because the system can become unresponsive or hang, impacting availability but not confidentiality or integrity. This flaw maps to CWE‑754 (Deadlock).

The flaw is present in the Linux kernel audit subsystem. No specific kernel version range is listed in the CNA data, so the search should focus on recent kernels where the audit module is enabled.

Based on the description, the likely attack vector is a local user capable of renaming files that match an audit executable filter to trigger the deadlock, potentially causing a system-wide service disruption. There is no EPSS score available and the vulnerability is not listed in CISA KEV. The CVSS score is not provided, but an attacker with local privilege or the ability to change file names in the audited directory can exploit this vulnerability. This scenario presents a high‑impact local denial‑of‑service.