A deadlock can arise in the Linux kernel when a PCI device reset thread holds a device lock and concurrently a device removal routine is invoked by the PCI core while already holding that same lock. The reset thread waits for the lock to release before completing, while the removal routine waits for the thread to finish, resulting in a state where neither side can proceed. This internal kernel condition can cause the kernel to become unresponsive or freeze without any observable user‑level impact. The fix replaces the blocking lock acquisition with a non‑blocking try‑lock, allowing the kernel to immediately back away if the lock is contended and preventing the deadlock. Based on the description, it is inferred that the attack vector is limited to privileged kernel context; the fault cannot be triggered from user space and requires normal PCI device operation that results in reset and removal. The vulnerability is a classic resource‑ordering issue (CWE‑424) and an operation on a resource in an inconsistent state (CWE‑833).

All Linux kernel releases that include the pds_core driver before the application of the commit referenced in the CVE details. Specific kernel versions are not listed in the data, so the coverage is broad across any kernel that contains the affected module prior to the patch commit.

The CVSS score of 4.1 indicates low severity, and the EPSS score of < 1% reflects a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, further underscoring its limited exposure. Because triggering the deadlock requires normal device reset and removal sequences within the kernel, it is considered a local kernel‑level issue that can lead to a denial‑of‑service via kernel freeze rather than a compromise of confidentiality or integrity.