The vulnerability in concurrent-ruby's Concurrent::ReentrantReadWriteLock arises from storing thread-local read and write hold counts in a single integer where the low 15 bits represent the read hold count and bit 15 indicates a write lock. When a thread acquires the read lock 32,768 times, the read count overflows into the write-lock bit, causing try_write_lock to incorrectly report that the thread holds a write lock without setting the global writer bit. This breaks the mutual exclusion property by allowing other threads to hold or acquire read locks concurrently, violating lock semantics. The flaw is resolved in version 1.3.7.

The core mutual-exclusion guarantee of the lock is broken, potentially allowing multiple threads to hold read and write locks simultaneously. This can lead to race conditions and inconsistent state in applications relying on this lock for concurrency control. However, the CVSS score is low (2.0), indicating limited impact or exploitability, and no known exploits are reported.

Upgrade concurrent-ruby to version 1.3.7 or later, where this vulnerability is fixed. No other official remediation or temporary fix is indicated. Patch status is confirmed by the version fix information.