The flaw lies in the Linux kernel’s writeback subsystem, specifically the cleanup_offline_cgwb() routine. Each invocation scans the wb->b_attached and wb->b_dirty_time lists from the same end, leaving inodes that cannot be switched in place. With each pass a larger segment of the list is rescanned, turning an expected linear drain into a quadratic operation. Under heavy inode workloads, such as when ~17 million inodes are attached to a dying writeback workqueue, CPU usage spikes and the system experiences soft lockups lasting from 21 to 48 seconds, effectively halting responsiveness.

All Linux kernel releases that include the default writeback logic before the patch commit 2d1da58c79b66646721a644c6eb4dd1f9c5c9327 are affected. This includes mainstream distributions—Ubuntu, Debian, Red Hat Enterprise Linux, CentOS, Fedora—whichever ship upstream kernels without custom modifications to the writeback subsystem.

No CVSS or EPSS values are published, indicating uncertainty about exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. Exploitation requires kernel‑level code execution or privileged actions that generate a massive inode workload. Once triggered, the system suffers a denial of service without any network interaction, making detection difficult until the lockup manifests.