A recursive locking deadlock in the Linux kernel audit subsystem, triggered by specific file operations, allows unauthenticated attackers to cause a system denial of service.

The vulnerability exists within the audit_dupe_exe function of the Linux kernel audit subsystem. When a file is renamed, the VFS layer locks the parent directory, and the audit subsystem attempts to re-acquire this same lock during rule duplication, causing a recursive locking deadlock that renders the system unresponsive.

Successful exploitation of this vulnerability results in a kernel panic or system freeze, leading to service unavailability. Given that this can be triggered by unprivileged processes or operations that rename files, it poses a significant threat to system stability in environments where audit rules are active. While the CVSS score of 7.5 reflects a high impact on availability, the nature of kernel-level deadlocks makes this a critical stability risk for production infrastructure.

Immediate Action: Apply the kernel updates provided by your distribution vendor that include the fixes for the audit subsystem, specifically ensuring you are running version 5.10.266, 5.15.217, 6.1.184, or later.

Proactive Monitoring: Monitor system logs and kernel crash dumps for signs of deadlocks or recursive locking warnings, specifically those referencing the audit subsystem or I_MUTEX_PARENT locks.

Compensating Controls: If patching is delayed, consider temporarily disabling audit rules that monitor file renames or moves to reduce the attack surface for this specific race condition.

Public Exploit Available: Unknown

The Linux kernel audit deadlock represents a significant risk to operational continuity. Security teams should prioritize the deployment of patched kernel versions across all affected systems. Failure to address this vulnerability may lead to unplanned downtime triggered by common file system operations.