The Linux kernel double‑unlock problem occurs during an emergency thaw of all frozen filesystems. When do_thaw_all() iterates over superblocks with a mandatory exclusive lock (s_umount) and then calls a callback that also releases the lock, the semaphore is unlocked twice, corrupting its internal state and triggering a DEBUG_RWSEMS warning. This corruption can cause a kernel panic, resulting in a denial of service.

The issue affects all Linux kernel releases that include the do_thaw_all() path unchanged by the fix. The underlying version information is not listed in the CVE data; the patch was applied in the 7.2.0‑rc4‑00001 release and later mainline commits, meaning any kernel built before the commit 503d67fbaec6fdeaba391cb497675071db9d16ea remains vulnerable.

Because the trigger is the Emergency Thaw sysrq command, exploitation requires privileged or local access that can issue the sysrq request. No public exploit has been reported and the CVSS, EPSS and KEV scores are not available. Nevertheless, the corruption of kernel locking can result in a critical kernel crash, so the risk is high for environments where an attacker could gain privileged access.