The vulnerability in the Linux kernel's md subsystem involves a deadlock triggered when "clear" is written to the array_state sysfs attribute. The md_attr_store() function breaks sysfs active protection to allow the array to delete itself but drops the mddev reference too early. This can cause the last kobject reference to be dropped during the current sysfs write context, leading to recursive locking and a deadlock in kernfs removal. The fix restores active protection before releasing the mddev reference, ensuring safe kobject teardown after the sysfs write completes.

This vulnerability can cause a kernel deadlock (denial of service) when clearing an md array via sysfs. There is no impact on confidentiality or integrity, but availability is affected due to the deadlock condition.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, avoid writing "clear" to the array_state sysfs attribute on md devices to prevent triggering the deadlock.