A race condition exists in the Linux kernel’s CSD lock handling when debug mode is enabled. The non‑atomic setting of the csd_flag allows multiple CPUs to concurrently observe an unlocked state, set the flag, and overwrite each other’s callback fields. This can result in an enqueue of duplicate llist nodes, creating a circular reference that blocks the target CPU while walking the call_single_queue. Subsequent synchronous work such as a TLB shootdown may remain queued, triggering soft‑lockup warnings or kernel panics. The flaw therefore permits an attacker to destabilize the system, although it does not provide direct code execution.

The vulnerability affects the Linux kernel when CSD lock debugging is enabled. The specific vendor and product are Linux:Linux. Affected kernel versions are those that contain the old non‑atomic csd_lock implementation; any kernel build without the fix commit (b0473dcd4b1d) is at risk. No exact version range is documented, so any distribution using a kernel older than the fix compiled with CSD lock debugging on should be considered vulnerable.

The CVSS score of 5.5 signals a medium severity, while the EPSS score is less than 1% indicating a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require triggering CSD lock debugging or relying on it being enabled, and provoking concurrent remote senders to target the same CPU. Although the impact is severe – a kernel panic or lockup – the practical attack surface appears limited to hosts running with CSD lock debugging enabled. Nevertheless, immediate mitigation is recommended due to the potential for denial of service.