The flaw causes an infinite loop in the Linux kernel 9p client when a fatal signal, such as SIGKILL, is delivered to a thread executing the P9_TFLUSH operation over an fd transport that has no peer. The loop repeatedly clears a thread‐flag without rechecking the pending signal, leading to a thread that never wakes and never calls the release routine. In practice this manifests as a coredump wait that stalls indefinitely, blocking the entire process and potentially affecting other system activities. The attack vector appears local: an attacker must generate a fatal signal against a process that is performing this specific 9p operation, which can be triggered through a coredump of a multi‑threaded user process.

The bug exists in all Linux kernels from version 5.4 onward, including current stable releases such as 6.12.77+. It is present in the mainline kernel and any distributions shipping these versions without applying the kernel patch that fixed the loop. Updated kernels newer than the patch timefully resolve the issue.

The vulnerability leads to a kernel thread that can hang indefinitely, effectively creating a denial‑of‑service condition when a coredump is attempted. Exploitation requires that the attacker can cause a fatal signal on a thread performing the problematic 9p call, a condition that is typically local and may be limited to processes that can be killed or that invoke a coredump themselves. No public exploit it is not currently listed in the CISA KEV catalog and the EPSS score is unavailable, suggesting that the likelihood of widespread exploitation is unclear but the potential impact on a compromised host is significant. The overall risk is moderate to high for systems that rely on 9p client transports without active servers, especially if coredumps can be triggered.