The flaw lies in the Linux kernel’s writeback subsystem, specifically the cleanup_offline_cgwb() routine. Each invocation scans the wb->b_attached and wb->b_dirty_time lists from the same end, leaving inodes that cannot be switched in place. With every pass a growing segment is rescanned, turning an expected linear drain into a quadratic operation. When a large number of inodes—about 17 million in the reported case—are attached to a dying writeback workqueue, CPU usage spikes and the system experiences soft lockups lasting from 21 to 48 seconds, effectively halting responsiveness.

All Linux kernel releases that contain the default writeback logic before the patch commit 2d1da58c79b66646721a644c6eb4dd1f9c5c9327 are affected. This includes any distribution that ships an upstream kernel without custom modifications to the writeback subsystem.

The CVSS score of 4.7 indicates moderate severity, and the EPSS score of less than 1 % shows a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require a scenario where a large inode workload is present; under those conditions the kernel can enter a soft lockup, causing a denial of service. It is inferred that no network interaction is required, so the impact is limited to systems running the affected kernel version.