The Distributed Lock Manager in the Linux kernel incorrectly orders the sequence numbers of message handles in its send queue. Because dlm_receive_ack depends on the oldest sequence number being the first element, any deviation causes the acknowledgment routine to skip older packets, leading to ref‑counting errors and use‑after‑free of the associated buffers. This planar memory corruption can crash the kernel or leave it in an unstable state when the bug is exercised. The flaw is triggered by a high volume of DLM traffic, such as in benchmark scenarios or workloads that use io_uring, but could also manifest during normal activity if the pattern of messages is sufficiently dense.

All Linux kernel releases that include an active DLM implementation are potentially affected, regardless of exact kernel version. Systems that run workloads generating heavy DLM traffic—especially those involving io_uring or distributed lock operations—are the most susceptible if the patch restoring correct send_queue ordering has not been applied.

The CVSS score of 9.8 marks the defect as critical. The EPSS score is reported as less than 1%, and the vulnerability is not listed in CISA's KEV catalog, indicating no publicly known exploits yet. Based on the description, an attacker would likely need to influence or control a process that sends DLM messages or generate excessive DLM network traffic to trigger the flaw, implying a local or compromised‑process attack vector rather than a direct network exploit. The primary risk therefore is accidental kernel instability or crash during intensive DLM operations rather than immediate remote exploitation.