The vulnerability involves an incorrect accounting of bio objects in the Linux kernel’s MD RAID1 and RAID10 subsystems. When a bio is split and resubmitted on an error path, the previous logic can double‑count cloned bios or omit accounting entirely. This mis‑accounting can lead to resource mismanagement, potentially causing the system to become unresponsive or unstable, thereby creating a denial‑of‑service condition due to improper resource accounting.

All Linux kernel versions that include the md/raid1 and md/raid10 code paths prior to the commit that introduced the bio accounting fix are potentially affected. If the kernel build has not been updated with the patch, it could be present in any kernel release before that change.

The CVSS score is 5.5, indicating medium severity, but the EPSS score indicates a less than 1% exploitation probability and KEV does not list the vulnerability, so the calculated risk is low, however a potential for a denial‑of‑service impact still exists. The likely attack requires interacting with the RAID subsystem through I/O operations and would be local to the machine unless the device is exposed to an untrusted I/O source. The absence of the vulnerability in KEV suggests no known active exploitation, but the persistently vulnerable code could be leveraged by a determined attacker to degrade system availability.