The Linux kernel’s BPF subsystem allows NMI and tracepoint programs to re‑enter the per‑CPU or global LRU lock that the bpf_lru_pop_free()/push_free() routine already holds on the same CPU. This re‑entry can trigger a deadlock, leading lockdep to report inconsistent use and recursive locking detected. The deathlock can halt kernel progress, resulting in a system hang or denial of service. The underlying weakness is a locking mechanism failure (CWE‑833).

The bug affects all Linux kernel releases that include the original bpf LRU lock implementation and have not applied the patch that converts every LRU lock site to rqspinlock_t. Because the CVE does not list specific kernel versions, any unpatched kernel that uses BPF programs with NMI or tracepoint capabilities is vulnerable—particularly systems running custom configurations or older distributions.

The CVSS score of 5.5 reflects a moderate severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation. An attacker with the ability to load or modify BPF programs can trigger a kernel deadlock. Exploitation requires local privileged access or a privilege escalation that grants BPF loading rights. The CVE is not listed in the CISA KEV catalog, so no widespread active exploitation is reported at this time; the crash mode still represents a serious denial‑of‑service threat. The patch introduces recovery paths to avoid node leaks and eliminates recursive lock acquisition, restoring normal kernel operation.