The Linux kernel contains a double‑unlock bug in its emergency thaw path. When the kernel receives an Emergency Thaw sysrq command, do_thaw_all() iterates over all superblocks while holding the s_umount lock exclusively. The callback thaw_super_locked() releases that same lock, resulting in a second unlock that corrupts the rwsem internal state and triggers a DEBUG_RWSEMS warning. While the description stops short of stating a crash, the corrupted lock state can lead to kernel instability or unexpected behavior. The weakness originates from CWE‑765, reflecting improper handling of lock ownership.

All Linux kernel builds that predate the application of commit 503d67fbaec6fdeaba391cb497675071db9d16ea contain the vulnerable do_thaw_all() code path. This includes kernel releases before the patch that switches to SUPER_ITER_UNLOCKED and secures s_umount in the callback. Any distribution kernel that incorporates the older source code is susceptible.

The CVSS score of 4.1 denotes moderate severity. The EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of widespread exploitation. Based on the description, the attack requires local, privileged access to invoke the Emergency Thaw sysrq command; this inference is drawn from the fact that sysrq operations are typically restricted to root users. No public exploit has been documented, and the practical risk is confined to environments where privileged users can trigger the vulnerable code path, which may result in lock corruption and potential kernel instability.