The flaw causes an infinite loop in the Linux kernel 9p client when a fatal signal, such as SIGKILL, is delivered to a thread executing the P9_TFLUSH operation over an fd transport that has no peer. The loop repeatedly clears a thread‑flag without rechecking the pending signal, leading to a thread that never wakes and never calls the release routine. In practice this manifests as a coredump wait that stalls indefinitely, blocking the entire process and potentially affecting other system activities.

The bug exists in all Linux kernels from version 5.4 onward, including current stable releases such as 6.12.77+. It is present in the mainline kernel and any distributions shipping these versions without applying the kernel patch that fixed the loop. Updated kernels newer than the patch timefully resolve the issue.

The vulnerability leads to a kernel thread that can hang indefinitely, effectively creating a denial‑of‑service condition when a coredump is attempted. Exploitation requires that the attacker can cause a fatal signal on a thread performing the problematic 9p call; based on the description, it is inferred that the attacker must generate such a signal against a kernel thread executing a P9_TFLUSH operation over an fd transport with no peer, a condition that is typically local. No public exploit is known, it is not listed in the CISA KEV catalog, and the EPSS score is 0.00206 (0.206%), indicating a very low probability of exploitation. The overall risk is moderate to high for systems that rely on 9p client transports without active servers, especially if coredumps can be triggered. The CVSS score is 5.5.