The bug occurs in the Linux kernel’s emergency thaw path when a frozen block device is thawed while the superblock lock (s_umount) is already held. The code do_thaw_all_callback() calls bdev_thaw() while holding the s_umount lock, which in turn attempts to acquire the same lock again through fs_bdev_thaw(). This double acquisition leads to a deadlock that blocks the worker thread, preventing any subsequent unmount, freeze, or thaw operations on that filesystem and its block device. The result is a state where the system can no longer cleanly unmount or recover the affected filesystem, effectively causing a denial‑of‑service condition. The issue is a classic lock‑ordering flaw that can be classified as a deadlock vulnerability.

Any Linux kernel installation that has not applied the recent commit that removes the s_umount lock from the emergency thaw loop is affected. This includes all upstream kernel releases and any derivative distributions that have not patched the issue yet. The patch replaces the lock with an active superblock reference and restores proper lock ordering.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of <1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog and no publicly disclosed exploits exist. Exploitation requires the ability to trigger a block‑layer freeze followed by an emergency thaw, which typically necessitates elevated privileges or a platform where such operations are executed (e.g., cloud snapshots or backup scripts). The attack vector is therefore likely local or requires administrative privilege. While the deadlock can severely disrupt system availability, the lack of known exploits and the privileged nature of the required operations suggest a moderate risk in environments that frequently use freeze/thaw mechanisms.