A race between a wakeup that sets the IO_POLL_RETRY_FLAG and a consumer loop can cause the kernel to stall while waiting for an unrelated wakeup to clear the flag. This stalls the task handling the poll request until another event occurs, effectively blocking the involved IO_uring poll until an unrelated interrupt arrives. The result is a denial of service for the task and potentially for the system if many tasks are blocked in this manner.

The vulnerable code exists in the Linux kernel across all releases before the patch was applied. The kernel source indicates the issue was addressed in the upstream repository, but no specific version range is listed in the advisory. All systems running an affected kernel without the upstream commit are potentially affected.

The publicly available advisory does not provide a CVSS score, and the EPSS is not reported, so the quantitative exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog, implying no known public exploits. Based on the description, it is inferred that the likely attack vector is local code that can trigger the kernel’s poll wakeup mechanism, requiring elevated privileges to manipulate io_uring poll behavior. Attackers would require such ability, so the primary attack surface is local privilege escalation or a kernel module that improperly uses io_uring poll. In the absence of an exploit, the risk is moderate, but any denial of service impact on critical services warrants prompt remediation.