The vulnerability in the Linux NILFS2 filesystem driver allows an attacker to trigger a null pointer dereference when a NILFS_IOCTL_CLEAN_SEGMENTS ioctl is issued immediately after mounting the filesystem, before any btree operations on the DAT inode have occurred. This flaw can lead to a general protection fault and a kernel crash, denying service for the affected system. The weakness is a classic NULL pointer dereference (CWE‑476) and a concurrent misuse of uninitialized data (CWE‑824) that occurs during the garbage collection process.

All Linux systems that run a kernel incorporating the NILFS2 driver prior to the patch provided in commit 41de342278ae025c99cc8d33648773f05e306cf1. The issue affects the infrastructure that mounts and uses the Nilfs2 filesystem, regardless of distribution, because the vulnerability resides in the core kernel code rather than a distribution‑specific module.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of < 1% shows a very low estimated probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local user who can perform the NILFS_IOCTL_CLEAN_SEGMENTS ioctl on a mounted Nilfs2 filesystem; a privileged or unprivileged user can cause the fault once the ioctl is invoked before any btree activity has initialized the i_assoc_inode cache. The attack results in a kernel panic and a denial of service.