The vulnerability is a race condition in the Linux kernel’s netconsole subsystem. drop_netconsole_target() violates proper locking by unlinking a target while holding only target_list_lock. Simultaneously, when a network interface is unregistered, netconsole_netdev_event() moves the same target into target_cleanup_list, and netconsole_process_cleanups_core() processes that list under target_cleanup_list_lock. Because these two execution paths use disjoint locks while operating on the same list node, a user removing a configfs target can cause list_del() to corrupt the list, leading to an out‑of‑band kernel crash. The impact of a kernel crash is a complete denial of service for the affected system. The edge case requires local privilege or control over netconsole configuration, but once triggered the privilege barrier is overcome by the crash itself, allowing an attacker to disrupt system operation. The CVSS score is not disclosed, and the EPSS score is unavailable, but the severity remains high due to the catastrophic nature of the crash. The vulnerability is not listed in the CISA KEV catalog, and no public exploit is known, so the likelihood of exploitation depends on the presence of netconsole and local privileged access.

All Linux kernel builds that include the netconsole subsystem and have not yet incorporated the commit that adds target_cleanup_list_lock to drop_netconsole_target(). The affected code is present in the generic Linux:Linux kernel across its releases.

Without the patch, the flaw is a moderate‑to‑high risk because an attacker with local privileges or the ability to manipulate netconsole configuration can trigger a list corruption that crashes the kernel. The EPSS score is not available and the flaw is not in the KEV list, indicating no current widespread exploitation. The flaw’s severity remains high because the consequences are a full denial of service through a kernel panic.