The vulnerability exists in the Linux kernel’s network failover subsystem, where the routine that changes a slave interface name can deadlock the kernel’s network device lock. A deadlock would freeze network operations or the entire system if the lock cannot be released, leading to a denial‑of‑service condition. The flaw is a classic lock ordering error that prevents the OS from progressing normally during failover configuration changes.

The affected products are all Linux kernel releases that contain the vulnerable net_failover module. No specific kernel versions are listed, but the fix applies to the current stable line and any downstream builds that have not applied the commit to resolve the deadlock.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% suggests a very low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve an attacker with CAP_NET_ADMIN privileges initiating network‑link configuration changes that trigger a slave name change, which can deadlock the network device lock and freeze network operations. The threat remains local or can be escalated if higher privileges are obtained, and a successful deadlock would result in a denial‑of‑service until a reboot or manual recovery.