The flaw occurs in the NFSv3 creation path of the Linux kernel. When the server resolves a create request and encounters an alias that points to a directory, it fails to return an error and silently discards the alias. This leaves the intended file dentry in a negative state, which is later passed to the open path and triggers a kernel panic. The resulting crash causes the NFS server, and potentially the whole host, to become unreachable.

All Linux kernel builds that include the unpatched NFSv3 implementation are affected. No specific version numbers are supplied, so any distribution running a kernel before the commit that fixed this behavior is vulnerable. The CVE does not distinguish between distributions; thus standard Linux servers exposing an NFSv3 service are at risk.

A remote attacker with network access to an NFS server can trigger the bug by issuing create operations on a name that simultaneously exists as a directory alias, especially when O_EXCL is not used. The likely attack vector is a crafted NFS client request. The CVSS score of 5.5 indicates medium severity, and with an EPSS score of 0.00018 (indicating a very low probability of exploitation), and not listed in the CISA KEV catalog, the vulnerability poses a moderate risk of denial of service that can be exercised remotely. No public exploit has been observed, yet the straightforward trigger makes the vulnerability moderately exploitable.