The vulnerability is a race condition in the Linux kernel that allows the TIF_NOTIFY_SIGNAL flag to be set and cleared in a manner that interferes with the normal operation of kernel_wait4(). Because the flag is cleared before each wait but can be re‑asserted by livepatch mechanisms such as klp_send_signals, the reaper thread can bypass its expected sleep and return –ERESTARTSYS prematurely or enter a busy‑wait loop. This race condition (CWE‑362) can cause abnormal CPU usage and severe denial of service for processes that rely on wait4() semantics.

All Linux kernel versions that do not include the patch introduced by commit 7fea700e04bd are affected. Specifically, kernels that are configured for livepatching or that use the klp_send_signals module may experience the flaw. No exact kernel version list is provided, so any installation running before the commit and not yet updated is potentially vulnerable.

Because the flaw requires manipulation of the TIF_NOTIFY_SIGNAL flag from kernel space, the attacker must have elevated (root or kernel) privileges. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that no public exploit is known. Nonetheless, a local privileged user could repeatedly trigger the busy‑wait and induce high CPU consumption, leading to a denial of service. The overall risk is moderate, largely dependent on the existence of an active livepatch and the privilege level of potential attackers.