A bug in the Linux kernel’s writeback logic causes the wait_sb_inodes() function to skip data‑integrity checks for filesystems that do not provide them, such as FUSE mounts. When a FUSE server fails to acknowledge write requests, the waiting loop can block indefinitely, resulting in a denial‑of‑service condition that stalls sync operations and can leave higher‑level processes hanging. The weakness is identified as CWE‑835.

This issue is present in the Linux kernel starting from the 6.19 release candidates through rc6, as indicated by the CPE strings. Any kernel build that incorporates the unchanged writeback code is vulnerable, and upstream stable kernels that eventually receive the patch will also be affected. No specific distribution names were supplied, so all Linux kernel installations that have not applied the fix are at risk.

The CVSS score of 5.5 places the vulnerability in the medium severity range. The EPSS score of less than 1 % suggests a low chance of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a faulty or malicious FUSE server that the target system mounts, making the attack vector local or remote to the mount point. While the impact is limited to the host executing sync operations, it can lead to resource starvation or a hung system, but does not grant privilege escalation or data theft.