The vulnerability in the Linux kernel allows a caller of dm_poll_bio() to request multiple cycles of polling on a target block device, causing the kernel’s blk_mq_poll() routine to spin within dm_poll_bio(). This excessive spinning can stall the RCU subsystem, preventing it from progressing and effectively freezing kernel threads that rely on RCU. The result is a denial‑of‑service condition where I/O operations and potentially all system activity become unresponsive until the RCU stall clears or the system is rebooted. The weakness is rooted in improper handling of poll flags and unbounded polling loops, corresponding to uncontrolled resource consumption.

The defect is present in all Linux kernel releases that implement dm_poll_bio() without the one‑shot polling guard; exact version ranges are not specified in the data. Any machine running a affected kernel and using dm‑based devices (such as dm‑stripe) with io_uring IOPOLL enabled is potentially exposed.

The CVSS score of 5.5 indicates a moderate severity, and the EPSS score of <1% suggests a very low, but non‑zero, likelihood of exploitation. However, since the flaw exploits normal io_uring usage patterns and requires only that a task perform I/O on a dm‑stripe device, the attack vector is inferred to be local or remote code that can enqueue io_uring IOPOLL operations. The failure mode is a RCU CPU stall that can sever system responsiveness. The vulnerability is not currently listed in the CISA KEV catalog. Until a patch is released, the best assessment is that the risk is significant, but the exploitation probability remains low.