During block I/O operations, the Linux kernel incorrectly sets the RQF_USE_SCHED flag based on the operation that allocated a cached request rather than the operation that ultimately claims the request. This mistake can cause the flag to be carried over to a different read or write bio, inserting the request into the scheduler without the proper preparation path and releasing it without the finish path. The unintended behavior leads to leakage of authentication domain tokens acquired during dispatch and can stall the block queue.

All Linux kernel builds that have not incorporated the blk-mq RQF_USE_SCHED fix are affected. The patch was introduced in kernel commits referenced in the advisory; any kernel version prior to those commits remains vulnerable.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of < 1% shows a low probability of exploitation. This vulnerability is not listed in CISA KEV. The issue could be exploited by a local attacker who can issue specialized I/O requests that trigger the stale flag condition, potentially leaking kernel credentials and causing a denial of service through queue stalls. No public exploits are documented, and the need for precise I/O manipulation limits its likelihood. Nevertheless, the kernel-level nature of the flaw warrants caution.