The vulnerability is a race condition in the Linux kernel’s netconsole subsystem. drop_netconsole_target() violates proper locking by unlinking a target while holding only target_list_lock. Simultaneously, when a network interface is unregistered, netconsole_netdev_event() moves the same target into target_cleanup_list, and netconsole_process_cleanups_core() processes that list under target_cleanup_list_lock. Because these two execution paths use disjoint locks while operating on the same list node, a user removing a configfs target can cause list_del() to corrupt the list, leading to an out-of-band kernel crash. The impact of a kernel crash is a complete denial of service for the affected system. The edge case requires local privilege or control over netconsole configuration, but once triggered the privilege barrier is overcome by the crash itself, allowing an attacker to disrupt system operation. The CVSS score of 5.5 indicates a moderate level of severity, and the EPSS score is reported as < 1%, showing a very low but nonzero likelihood of exploitation; the impact remains high due to the catastrophic nature of the crash. The vulnerability is not listed in the CISA KEV catalog, and no public exploit is known, so the likelihood of exploitation depends on the presence of netconsole and local privileged access.

All Linux kernel builds that include the netconsole subsystem and have not yet incorporated the commit that adds target_cleanup_list_lock to drop_netconsole_target(). The affected code is present in the generic Linux:Linux kernel across its releases.

Without the patch, the flaw is a moderate‑to‑high risk because an attacker with local privileges or the ability to manipulate netconsole configuration can trigger a list corruption that crashes the kernel. The CVSS score of 5.5 indicates a medium severity, while the EPSS score is <1% and the flaw is not listed in KEV, suggesting limited exploitation. The consequence is a full denial of service through a kernel panic.