The vulnerability arises from a recursive locking deadlock in the Linux audit subsystem when duplicate executable rules are handled during file moves. The deadlock occurs when audit_dupe_exe() calls audit_alloc_mark(), which in turn attempts to acquire a directory lock already held by the task, leading to a blind recursion that blocks progress. The result is a denial of service because the system can become unresponsive or hang, impacting availability but not confidentiality or integrity. This flaw maps to CWE‑833 (Lock ordering issue).

The flaw is present in the Linux kernel audit subsystem. No specific kernel version range is listed in the CNA data, so the search should focus on recent kernels where the audit module is enabled.

Based on the description, the likely attack vector is a local user capable of renaming files that match an audit executable filter to trigger the deadlock, potentially causing a system‑wide service disruption. The EPSS score is < 1%, indicating low but non-zero exploitation probability, and the CVSS score is 7.5, which is a high severity. The vulnerability is not listed in CISA KEV. An attacker with local privilege or the ability to change filenames in the audited directory can exploit this vulnerability, resulting in a denial of service that could impact system availability.