An internal race condition in the Linux kernel’s anonymous VMA preparation code allows two concurrent page faults on adjacent anonymous memory areas to interleave in a way that disables the lock publication barrier. This missing synchronization permits a use‑after‑free of the anon_vma root structure and causes the kernel’s rwsem to be left in an inconsistent state. The result is a deadlock where one VMA never unlocks, preventing other VMA locks from being acquired and causing a task to hang indefinitely. The effect is a denial‑of‑service that can freeze user processes or the entire system. Based on the description, it is inferred that the missing barrier affects the generic mm/rmap code, potentially impacting all architectures that use this code path.

The Linux kernel runs on many architectures. The advisory references an arm64 server running a 5.10.0‑0021 build; however, the core mm/rmap code is shared across archs. Based on the description, it is inferred that any kernel compiled without the commit adding the missing barrier is vulnerable. The vendor in question is Linux itself; there are no other products or third‑party vendors explicitly mentioned.

There is no publicly disclosed exploit for this issue, and the EPSS score is below 1%. The CVSS score of 7.8 indicates high severity. The attack requires two threads to fault concurrently on adjacent anonymous VMAs, which is inferred to need a local attacker that can induce such concurrent faults. The kernel‑level deadlock can freeze a task or the entire system, producing a denial of service. The issue is not listed in CISA KEV.