The vulnerability in the Linux kernel’s dm‑io subsystem occurs when the kernel builds destination bio objects for DM_IO_BIO requests. Instead of re‑existing logic, the implementation walks the source bio’s biovec, copies pages, and performs sector‑based accounting. Misaligned O_DIRECT buffers can cause the sector accounting to truncate remnants, leading to an infinite loop of empty bios that hang I/O operations, resulting in a denial‑of‑service condition affecting dm‑mirror devices.

Affected systems are deployments of the Linux kernel running the device-mapper module, particularly those using dm‑mirror targets. The bug is tied to the dm‑io component of the kernel; no specific kernel release versions are enumerated in the advisory, so all affected kernels that include the flawed implementation are potentially vulnerable.

The CVSS score of 4.1 indicates low severity, and the EPSS score is approximately 0.2% (well under 1%), signifying a very low probability of exploitation. This vulnerability is not listed in CISA’s KEV catalog. The flaw is triggered by misaligned O_DIRECT I/O requests to a dm‑mirror device; an attacker must be able to direct such I/O, which typically requires local or privileged access. When triggered, the kernel enters an infinite loop of empty BIO submissions, hanging all I/O operations against the affected device and causing an availability disruption.