The flaw exists in the Linux kernel’s rqspinlock implementation, where a deadlock detection pathway suppresses the destruction of the waiter queue but fails to reset the tail pointer or signal the next waiter in the queue. When an ABBA deadlock occurs, the kernel may end up waiting for a non‑existent node pointer, causing a thread to stall indefinitely. This is a classic synchronization flaw that can result in kernel stalls or hangs, impacting system availability. The weakness is identified as deadlock (CWE-821).

Any Linux kernel that includes the default rqspinlock code is vulnerable, regardless of upstream vendor or distribution. All current and future kernels built from the upstream source without the upstream patch are potentially affected. Custom kernels that have removed or modified this code may not be impacted. The vulnerability does not appear to be limited to a specific distribution or kernel version beyond those containing the default implementation.

With a CVSS score of 5.5, the vulnerability is rated moderate. The EPSS score of < 1% indicates a very low likelihood of exploitation in the wild, and it is not listed in CISA’s KEV catalog. The likely attack vector is a local, privileged attacker or a compromised kernel module that can orchestrate the ABBA deadlock interleaving required to trigger the stall. Remote exploitation would require host compromise to load malicious code or the ability to influence kernel internal scheduling. The impact is purely availability; confidentiality and integrity are not directly affected.