The bug arises from a circular lock ordering dependency in the OCFS2 file‑system driver. When a write operation finishes, the function ocfs2_dio_end_io_write acquires the EXTENT_ALLOC lock and subsequently attempts to acquire the ORPHAN_DIR lock while still holding EXTENT_ALLOC. The same sets of locks are taken in a different order elsewhere, creating a cycle. If two threads follow opposite ordering paths, they can deadlock, halting kernel progress and freezing the system. The impact is a denial of service that manifests as a system freeze for all users—a local effect triggered by file‑system activity on an OCFS2 volume.

Any Linux system whose kernel includes the OCFS2 driver before the patch. The flaw is present in the tree up to the commit referenced in the advisory links and can affect mainstream distributions that ship those kernel versions. Users should check whether their installed kernel revision incorporates the OCFS2 lock‑order fix and plan to upgrade if it does not.

No CVSS score or EPSS figure is public, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploitation yet. Nevertheless, the lock‑order condition means any local user who can perform read/write operations on an OCFS2 volume can trigger the vulnerability. The exploit requires local privilege and can cause a complete kernel deadlock, isolating the operating system. Given the lack of an active exploit, the immediate risk is moderate to high in environments with heavy OCFS2 usage, but it scales poorly to remote attackers.