This vulnerability arises because the Linux kernel performs the close‑on‑exec operation while it holds the exec_update_lock. The close operation can block while waiting for a reply from the filesystem. A hung or malicious filesystem, such as a FUSE driver that inspects the calling process, can therefore cause the holder of exec_update_lock to stall indefinitely, leading to a deadlock. The resulting denial of service can manifest as stalled processes or a full kernel hang, preventing new system calls that acquire exec_update_lock from completing.

All implementations of the Linux kernel that contain the legacy ordering of do_close_on_exec() before the exec_update_lock are affected. The vulnerability exists in kernel versions built prior to the change that moved do_close_on_exec() outside the lock. Administrators should inspect the running kernel version and apply the patch in a newer kernel release that includes the reordering fix. The Linux kernel is the sole vendor implicated. No specific product sub‑versions are listed.

The EPSS score of < 1 % suggests a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly documented exploits. However, the potential impact could still be very high because a stalled process can propagate to a system‑wide hang. The likely attack vector is local or remote privilege escalation that can mount a malicious or hung filesystem, such as a FUSE file system that performs process inspection. Based on the description, an attacker who can induce a blocking filesystem can trigger the deadlock; this inference is drawn from the stated behavior of do_close_on_exec() blocking on filesystem replies. The CVSS score of 5.5 assigns a medium severity rating, reflecting the described denial‑of‑service impact.