The Linux kernel module dm‑verity tracks corrupted block errors using a counter (v->corrupted_errs). When this counter is accessed concurrently without atomicity, multiple threads can modify it simultaneously, creating a race condition. This flaw can cause the audit logging function dm_audit_log_target("max-corrupted-errors") to be invoked inconsistently or omitted entirely, so integrity violations may go unlogged. The vulnerability does not allow code execution or privilege escalation, but it weakens confidence in audit trails that rely on dm‑verity reporting.

All Linux kernel releases that include dm‑verity before the atomic counter change (identified by commit 089e05b644d5aa786c21af467c80b24d691becb1) are affected. This includes the generic kernel and any derivatives that have not incorporated the fix.

The likely attack vector is local; the description does not explicitly state it but the concurrent use of the dm‑verity counter implies that only a process with sufficient privileges to trigger a race condition on a dm‑verity mapped device could do so. The CVSS score is 5.5, indicating a moderate severity, while the EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating no known active exploit campaigns. The primary risk lies in degraded integrity monitoring rather than direct compromise.