The bug resides in the Linux kernel’s robust futex handling. During a robust unlock, the kernel clears the FUTEX_WAITERS flag and wakes one waiter, but if that waiter is terminated before it can acknowledge the wake, the kernel fails to relay the wake to subsequent waiters. The missing wake leaves later waiters sleeping indefinitely, which can cause application hang or system component stalling. The flaw is a race condition and does not provide code execution or privilege escalation.

All Linux kernel configurations that enable robust futexes are potentially affected. The CVE does not list specific kernel versions; any distribution running a kernel that lacks the recent commits adding the extra wake logic to robust list exit processing remains vulnerable. The required patches are referenced in the kernel tree but may not yet be merged into all downstream releases.

The CVSS score is 5.5 and the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local attacker who can use or spawn a process with a robust futex; it does not allow remote code execution but can cause denial of service. The attack vector is most likely that a local untrusted user or a compromised application can trigger the lock cycle and terminate a waiting thread. Because the flaw relies on timing, the probability of automatic exploitation is low, but for services that depend on robust futexes the risk remains moderate to high.