During error recovery in the Linux UFS driver, internal commands are queued on the pseudo SCSI device, which is tied to the same tagset as regular logical units. When error handling quiesces the entire tagset, the internal command queue remains quiesced and subsequent attempts to dispatch internal commands are skipped. This causes an unrecoverable deadlock that can stall the kernel, preventing further recovery actions and effectively freezing I/O to UFS devices. The weakness is a concurrency and resource management flaw, classified by CWE-833.

All Linux kernel releases that include the UFS core driver are affected. The issue is tied to any kernel build that uses the Universal Flash Storage subsystem, regardless of other configuration options. No specific version range is supplied, so any current or future kernel containing this code path may be vulnerable.

The CVSS score of 4.7 indicates a moderate severity, and the EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability manifests only during error handling, which requires a fault condition in the UFS driver. While the impact is severe when it occurs, the attack surface is limited to environments where UFS errors are present or can be triggered. The vulnerability is not listed in the CISA KEV catalog, so no publicly known exploits are documented.