The Linux kernel’s nsm character device contains a locking flaw that occurs when an ioctl fails before the mutex is acquired. The code flow jumps to a common unlock label even though the mutex was never locked, resulting in a bad unlock balance detected by lockdep and potentially a kernel panic that effectively terminates the host. Based on the description, the vulnerability can only be triggered through the misc device ioctl interface, indicating that the attack vector is local and requires an attacker to be able to invoke that ioctl.

All Linux kernel releases that lack the commit fixing the nsm_dev_ioctl unlock bug are affected. The precise affected version range is not specified, so any kernel built before the remediation commit remains vulnerable.

The CVSS score is 8.4, the EPSS score of <1% indicates a very low probability of exploitation, and the vulnerability does not appear in the CISA KEV catalog. The flaw is rooted in an uncontrolled unlock (CWE‑832). Even though a kernel crash would cause significant disruption, the risk of an active exploit is modest because the vector is local and there is no public evidence of exploitation.