In the Linux kernel, a state‑management flaw in the blk‑iocost subsystem prevents the block‑cgroup delay flag from being cleared when a policy object is freed. As a result, the block‑cgroup remains marked congested for its entire life, causing the kernel to treat every task in that cgroup as congested. This leads to throttled read‑ahead, suppressed asynchronous pre‑reads, and reduced swap activity on anonymous pages, effectively starving I/O resources and potentially causing application stalls or denial of data access.

The vulnerability affects the Linux kernel on all architectures that implement the blk‑iocost block‑cgroup subsystem. Kernel releases that do not include the patch commit 97cb95d2148835ae86ff916b145aef332d40439d are vulnerable; administrators should verify whether their running kernel predates this commit.

The CVSS score is unspecified, but the EPSS score is less than 1 %, indicating a low probability of widespread exploitation. Attackers would need the capability to create or manipulate block‑cgroup policies that trigger debt and subsequent removal, which typically requires kernel–module or privileged code execution. The vulnerability is not listed in the CISA KEV catalog. If exploited, the denial‑of‑service effect could degrade system performance over a prolonged period.