An infinite loop in the Linux kernel’s TIPC subsystem causes the genl_mutex to remain held indefinitely when the cmd->dumpit callback returns a negative error. Because the loop never terminates, the mutex is never released, causing other kernel tasks waiting for it to block in the D state. The result is a denial of service to privileged processes and to kernel operations that require the mutex, as described by CWE-252.

All Linux kernel releases that include the TIPC subsystem and lack the patch which checks the callback’s return value are vulnerable. The exact affected versions are not specified, but any kernel before the kernel commit that adds the error check may be at risk. Distributions should verify whether the kernel included in their system incorporates the relevant commit, or upgrade to a kernel that contains the fix.

The CVSS score of 5.5 and the EPSS score of less than 1% indicate a moderate severity and a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation has been reported. The likely attack vector involves sending a TIPC netlink request that causes the callback to return an error; based on the description it is inferred that the attacker must be able to issue netlink messages with CAP_NET_ADMIN or root privileges to trigger the error path. Once triggered, the infinite loop will cause blocking of other kernel tasks, leading to service disruption.