The Linux kernel suffered a locking bug in the nsm character device implementation. A copy_from_user() failure before the mutex was acquired caused execution to jump to a common unlock path that unlocks the mutex anyway, resulting in an unlocked or incorrectly unlocked mutex. This mismatch can trigger lockdep warnings and, in a kernel built with the appropriate safeguards, may cause a kernel panic or other stability issues. The vulnerability is local and requires the attacker to be able to invoke the nsm ioctl interface, but it could be leveraged to crash the host system and disrupt services or provide a foothold for further escalation.

All Linux kernel releases that contain the unpatched nsm_dev_ioctl() implementation are affected. The precise version range is not listed, but any kernel prior to the commit that introduced the fix referenced in the provided Git links is vulnerable.

The CVSS score is not publicly available, and the EPSS score is not provided, indicating that no widespread exploitation data exists. The vulnerability is not listed in CISA’s KEV catalog, which suggests a low probability of active exploitation. The attack vector is local through a misused ioctl on the misc device, meaning that privilege escalation is limited to a local user context. Given the lack of exploit evidence, the risk is moderate owing to the severity of a kernel crash but low in terms of exploit likelihood.