A race condition in the Linux kernel’s io_uring implementation causes write accounting to be deferred from the normal completion path to a task_work queue, and the deferral can prevent the superblock from releasing write protection. Based on the description, it is inferred that an attacker who can initiate writes and trigger a device freeze could cause a denial‑of‑service. This flaw involves improper synchronization (CWE-833).

All Linux kernel releases that include the vulnerable io_uring logic and that have not applied the fix that restores write accounting to the completion path are potentially affected. The fix is identified by commit b000145e9907. Any kernel lacking this change remains vulnerable, regardless of distribution, because the affected code is part of the core kernel source.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of <1% suggests a low probability of exploitation in the wild. Based on the description, it is inferred that an attacker would need privileged access to initiate writes and trigger a device freeze operation, which limits the likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed public exploits.