The vulnerability arises in the Linux kernel's io_uring implementation. When a wakeup handler queues work to the io_uring completion queue, the code signals the eventfd inline rather than deferring, causing recursion inside eventfd_signal_mask. Because the recursion flag is set only by the signalling function, the call can feed back into epoll and potentially trigger an unintended epoll callback. This race condition can lead to kernel instability or a denial of service. The weakness corresponds to a concurrency race (CWE-362).

The flaw affects all Linux kernel versions that include the vulnerable io_uring code, and therefore all distributions that ship with those kernels are impacted. The issue is confined to kernel components and does not extend to user‑space code beyond those that use io_uring interfaces.

No CVSS score is provided and EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. While the flaw requires local kernel execution or a program that can trigger io_uring operations, it can potentially deliver a denial‑of‑service or crash if the recursive signalling reaches an epoll handler. The likely attack vector is local and depends on exploiting the wake‑up handler race; there are currently no known public exploits. Administrators should treat the risk as moderate until a kernel update is applied.