The vulnerability in the Linux kernel phonet/pep module is due to inconsistent bottom half (BH) state handling when forwarding packets to child sockets via sk_receive_skb(). In process context, BH is enabled when acquiring the child socket lock, whereas in softirq context BH is disabled. This inconsistency leads to lockdep warnings and can cause self-deadlocks if a softirq attempts to receive on the same child socket while the lock is held with BH enabled. The resolution is to disable BH around the forwarded sk_receive_skb() call, ensuring the child socket lock is always acquired with BH off. This fix prevents the inconsistent lock state and potential deadlocks. The issue was discovered via syzkaller fuzzing and reproduced with KASAN, LOCKDEP, and PROVE_LOCKING.

The vulnerability can cause self-deadlocks in the Linux kernel networking stack when processing packets on phonet/pep sockets. This may lead to kernel hangs or degraded networking functionality on affected systems. There is no indication of remote code execution or privilege escalation. No known exploits are reported in the wild.

A fix has been implemented that wraps the forwarded sk_receive_skb() call with local_bh_disable() and local_bh_enable() to ensure consistent bottom half state during socket lock acquisition. Users should apply the official Linux kernel patch that addresses this issue. Since this is a kernel-level fix, upgrading to a kernel version containing this patch is the recommended remediation. Patch status is not explicitly provided here; check the vendor or Linux kernel mailing lists for the official fixed version.