The vulnerability arises from an incorrect memory ordering between setting an exit flag and cancelling queued worker creation tasks in the Linux kernel’s I/O workqueue subsystem. The missing barrier causes a worker to remain queued while the exit flag is not visible to other parts of the kernel on weakly ordered architectures, leading to an indefinite wait on the worker_done synchronization primitive. This results in a kernel‑level deadlock that can halt system shutdown or worker creation processes.

The flaw exists in the Linux kernel’s io‑wq implementation, affecting any release that incorporates the buggy code path while lacking the patch that inserts a memory barrier after the set_bit() operation. Specific vulnerable kernel versions are not listed; administrators should examine kernel change logs for the commit that added the barrier and verify that their running image includes it.

The risk is a denial of service that can be triggered by user‑space code that submits work to an io_uring or analogous workqueue during system shutdown. The exploit requires kernel‑sensitive execution and is only feasible on architectures with weak memory ordering, such as some ARM or MIPS variants. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalogue, indicating no publicly known active exploitation at this time. The potential for a critical service disruption warrants prompt remediation. The likely attack vector is inferred from the description of weakly ordered architectures and user‑space work submission during shutdown, as the input does not explicitly state how an attacker would trigger the condition.