In the Linux kernel, the bug prevents RCU tasks from seeing a quiescent state during a writeback cgroup drain. A draining writeback worker can run for minutes, and while it holds the trampoline mutex, any BPF unlink or ftrace detach that calls synchronize_rcu_tasks() waits for the drain to finish. Because the drain loop never reports a quiescent state, synchronize_rcu_tasks() blocks indefinitely, which can trigger a hung task detector and cause a kernel panic. The flaw enables a denial‑of‑service condition that can be triggered by any process capable of initiating a lengthy writeback drain or detaching BPF/ftrace programs while the kernel is in PREEMPT_LAZY mode.

Linux kernels on architectures that support PREEMPT_LAZY, such as arm64 and x86, are affected when CONFIG_PREEMPTION is enabled. The issue manifests in kernel versions where the preemption restriction commit is present, and the kernel drainer does not call cond_resched_tasks_rcu_qs(). The problem is tied to long‑running writeback drains on cgroups and becomes visible when BPF or ftrace detach operations are performed concurrently. No specific kernel release numbers are provided, but the example in the advisory shows the issue on kernel 6.18 arm64.

The vulnerability has a high potential impact because it can halt the entire system by causing a kernel panic after a prolonged writeback drain. Exploitation requires local access or the ability to trigger a long writeback drain and perform a BPF unlink or ftrace detach, which is feasible for privileged users or applications that use these features. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, but the severity of an induced panic makes the risk substantial. Affected systems should treat this as a high‑risk issue and apply the fix promptly.