A race condition exists in the Linux kernel’s rxrpc subsystem where the rxrpc_wake_up_io_thread function checks a thread pointer, reloads it, and may call wake_up_process on a NULL value because the pointer is cleared with WRITE_ONCE when the I/O thread exits. The race can cause a NULL dereference of wake_up_process, leading to a kernel panic and a denial‑of‑service for the affected system. This vulnerability stems from improper synchronization of shared data across threads, a classic race condition flaw.

All Linux kernel releases that contain the legacy rxrpc implementation are affected. The issue is identified through global CPE strings that reference any Linux kernel version. No specific version range is provided, so any system running an unpatched kernel is potentially vulnerable until a compensated fix is installed.

The CVSS score of 5.9 indicates a moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, indicating no publicly confirmed exploits. This race condition can be triggered by manipulating rxrpc traffic, potentially causing a kernel panic and a denial‑of‑service, but specific attack conditions are not detailed in the description.