This vulnerability in the Linux kernel FAT filesystem arises when a corrupted FAT image leaves a directory inode with an incorrect link count. The rmdir handler unconditionally decrements the link count, which can underflow to zero and trigger a WARN_ON in drop_nlink(). The resulting kernel warning and possible crash cause a denial of service. The flaw is a straightforward integer underflow (CWE‑191) and does not provide code execution or privilege escalation.

All Linux kernel releases that include the unpatched vfat or msdos FAT drivers are affected. The vulnerability exists whenever the kernel is compiled with these drivers and a corrupted FAT volume is mounted. No specific version numbers are provided, so any kernel using the pre‑patch rmdir code is at risk.

The vulnerability is local in nature; an attacker would need to mount a corrupted FAT image or otherwise trigger deletion of directories on such a filesystem. The likely attack vector is a local attacker with access to mount points or local file deletion operations, and this inference is drawn from the description. EPSS is below 1 %, indicating a very low probability of exploitation in the wild. The CVSS score of 5.5 reflects medium severity, and the issue is not listed in CISA KEV, suggesting it is not currently a known exploited vulnerability. Because the bug only compromises availability on local systems, the overall risk is limited but a kernel crash can interrupt services.