The vulnerability originates in the OC routine, which calls a configuration‑filesystem helper while holding the spinlock o2hb_live_lock. Because the helper can sleep, this violates the non‑preemptive lock‑holding contract and triggers a BUG in code path also introduces a lock‑order inversion that can deadlock the kernel when the OCFS2 configuration is unregistered, and a failure during pinning leaks a counter that leaves heartbeat regions permanently pinned, undermining the integrity of subsequent mounts. Collectively, these issues can interrupt kernel operation, freeze the system, or de‑protect critical namespace data.

Any Linux kernel that includes the OCFS2 cluster filesystem is impacted, as the flaw resides in the o2hb_region_pin implementation. The patch series applies to all builds that contain the original code path, and no specific version information was provided in the CVE data. Therefore, affected builds are unspecified beyond the presence of the OCFS2 cluster filesystem.

The CVSS score of 4.4 categorises the flaw as a moderate‑severity issue,0.2 %, while the vulnerability is not listed in the CISA KEV catalog, indicating low current exploitation pressure. Attackability is largely local: who can trigger the problematic code path must have the ability to mount an OCFS2 filesystem, modify its configuration via configfs, or load the module in an unpatched kernel. The resultant denial of service is achieved by a kernel BUG or deadlock rather than by privilege escalation or data exfiltration.