The vulnerability exists in the Linux kernel’s network failover subsystem, where the routine that changes a slave interface name can deadlock the kernel’s network device lock. A deadlock would freeze network operations or the entire system if the lock cannot be released, leading to a denial‑of‑service condition. The flaw is a classic lock ordering error that prevents the OS from progressing normally during failover configuration changes.

The affected products are all Linux kernel releases that contain the vulnerable net_failover module. No specific kernel versions are listed, but the fix applies to the current stable line and any downstream builds that have not applied the commit to resolve the deadlock.

The CVSS score and EPSS probability are not publicly provided, and the vulnerability is not flagged in CISA’s KEV catalog. Because the stack trace shows rtnl_setlink and netlink message handling, the likely attack vector requires the attacker to send privileged network‑link configuration changes with CAP_NET_ADMIN privileges; therefore the exposure is local or may be elevated via compromised services. Even with the low exposure, a successful deadlock would cause prolonged outages until a reboot or manual intervention restores the network stack, giving attackers an impact comparable to a denial‑of‑service.