The vulnerability exists in the Linux kernel scheduler extension where ops.dequeue() is invoked while a dynamic scheduler queue (DSQ) lock is still held. This causes a recursion check in the kernel’s lockdep subsystem to trigger, resulting in a self‑deadlock. The deadlock stalls task scheduling, freezing all runnable processes and causing the system to become unresponsive. This is a concurrency control flaw that leads to denial of service; no direct data disclosure or code execution is involved.

All Linux kernel builds that include the unpatched scheduler routine are affected, as the bug resides in core scheduler code. The advisory refers to kernel git commits cb86607 and fe499ae, indicating that any kernel version prior to these changes can be vulnerable. Because the affected range is not enumerated, users should verify that their running kernel contains the fixes and upgrade if necessary.

The CVSS score and EPSS data are not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, requiring the attacker to load or modify a BPF scheduler that iterates over a user DSQ, which normally requires elevated privileges or the ability to execute untrusted BPF code. For systems that permit dynamic BPF programs and are not restricted by security modules, the risk is medium to high; for tightly controlled environments the risk is lower. Exploitation would result in an availability loss due to the scheduler deadlock.