The dm-integrity subsystem in the Linux kernel has a bug where, after a limit check failure, the module exits with DM_MAPIO_KILL while the range lock is already held and never released. This causes a deadlock that can freeze kernel operations or render the system unresponsive, effectively creating a denial‑of‑service condition. The weakness involves improper resource deallocation after an error path. The vulnerability is tied to CWE‑667 (Improper Resource Management) and CWE‑833 (Violating the Semantic Locking Rule).

All Linux kernel releases that do not include the dm-integrity limit‑check fix are affected. The flaw targets the dm-integrity kernel module on Linux systems, so any distribution packaging the default kernel and not yet patched is vulnerable. Vendors are Linux (kernel), and products are the standard Linux kernel, regardless of distribution. Versions prior to the fix commit should be considered vulnerable.

The CVSS score of 8.8 indicates high severity, while the EPSS score of < 1% shows a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, implying no publicly known exploits at this time. The likely attack vector is inferred to require local privileged or root access to trigger a kernel operation that forces dm_integrity_check_limits to fail, leading to the lock being held and not released. If an attacker can instruct the kernel to process an out‑of‑bounds block device request, the deadlock may be reproducible, causing a denial of service.