The vulnerability arises in the Linux kernel's readdir implementation for immutable directories without entries. During a getdents operation the code acquires a shared inode lock and holds it for the entire read. Because the directory never changes this lock is never released until the read completes, causing any other reader, writer or lookup on that inode to block. The result is a denial of service where a single user or process holding the lock can stall all other users or kernel threads sharing the same inode. This issue maps to CWE-412, a lock‑misuse weakness that serializes concurrent operations.

The affected systems include any Linux kernel that implements the early iterate_dir logic for immutable directories, notably the Nullfs and Libfs placeholder directories. The CVE does not specify an exact version range, but the issue applies to kernel releases prior to the commit that introduces the FOP_IMMUTABLE guard for empty directories. Administrators should verify that their running kernel contains that commit and, if not, upgrade to a kernel version where the fix is deployed. The vulnerability specifically concerns empty immutable directories that are shared across users or mount namespaces.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local user to perform a read on an empty immutable directory that is reachable from the attacker’s namespace. Once the read begins, the attacker can hold the lock for an arbitrarily long period, blocking other operations such as mkdir, lookup or mount on the same inode. Because the affected directories are uncommon and the lock is held only for read duration, widespread exploitation is unlikely, but in environments that use shared empty immutable directories the denial of service impact can be significant.