The flaw is in the arm64 kprobe mechanism of the Linux kernel. When a second kprobe hits while the first is in the KPROBE_HIT_SS state, the kernel treats this as an unrecoverable nested re‑entry and overwrites the outer probe’s saved kernel state, including the interrupt flag. This state corruption causes interrupts to remain disabled after the outer probe finishes, leading to a system hang or crash. The vulnerability is identified as CWE-1265, an improper operation of a component after a state change.

All arm64 builds of the Linux kernel that lack the recent commit adding recoverable re‑entry handling are affected. The vendor product is generic Linux; no specific version range is supplied, so administrators should confirm whether their kernel includes the fix or uses a newer release that incorporates the patch.

The CVSS score of 4.4 indicates moderate severity, while the EPSS score of < 1% suggests a very low probability of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. To trigger the vulnerability an attacker requires the ability to cause a kprobe single‑step re‑entry, which typically entails local privilege or a debugging/performance‑monitoring environment. Based on the description, the attack vector is inferred to be local, privileged, or a dedicated debugging scenario. If exploited, the kernel’s persistent interrupt disable would result in a denial of service to the entire system.