The vulnerability lies in the dmaengine idxd device driver, where failure paths in idxd_cdev_open() drop the file‑device reference while holding a workqueue lock. This causes the release routine to attempt to reacquire the same lock, leading to a deadlock, and can also cause a use‑after‑free of the driver context when cleanup proceeds after the context has already been freed. These race conditions can stall system processes or trigger a kernel panic, effectively denying service to the affected system.

All Linux kernel releases that contain the dmaengine idxd driver are affected until the patch that moves wq acquisition before potential failure is applied. The precise impacted versions are not listed in the CVE data.

To exploit this flaw an attacker would need to interact with the idxd device from user space, which implies local or privileged execution. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is not supplied, so the risk level is not formally quantified at present. The primary consequence is a denial of service via kernel deadlock or memory corruption, with potential for a subsequent compromise if a successful use‑after‑free leads to arbitrary kernel code execution.