Writing 0 to /proc/sys/debug/kprobes-optimization while a kprobe remains jump‑optimized causes the write operation to block in a D state indefinitely, keeping the kprobe_sysctl_mutex locked. Because the blocking thread never signals completion, all subsequent reads or writes to that sysctl hang as well, producing a system‑wide deadlock that effectively freezes the kernel. The flaw arises from improper use of a completion event together with a mutex, and it is related to CWE‑821.

The vulnerability affects any Linux kernel build that enables kprobe optimization, which is controlled by CONFIG_KPROBES and the corresponding debug interface. Any kernel version prior to commit 5bfa9f1a9dcb6ecb607adbc1c0226605c972935b contains the defect. Consequently, systems running older kernels—especially those that frequently use automated kprobe instrumentation—must verify whether they are running a patched kernel.

The CVSS base score of 4.4 indicates a moderate severity. The EPSS score is reported as less than 1%, implying a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would need local privileged access and would need to write to /proc/sys/debug/kprobes-optimization while kprobe optimization is active, which triggers the permanent kernel hang. Applying the patch removes the problematic completion logic and eliminates the risk.