In this vulnerability, a corrupted FAT file system can leave a directory inode whose link count (i_nlink) is incorrect. When the kernel’s rmdir path unconditionally decrements this link count, it can underflow to zero, triggering a WARN_ON in drop_nlink(). This incorrect update can lead to a kernel warning or crash, effectively causing denial of service on systems using that file system. The flaw is a kernel bug that does not provide remote code execution but can compromise availability if the attacker can influence the deletion of directories on corrupted FAT volumes.

The Linux kernel is affected, specifically the FAT filesystem support in the vfat and msdos drivers. All releases of the Linux kernel that compile these drivers without the patch are vulnerable. No specific version numbers are provided, so any kernel version using the unpatched vfat/msdos code is at risk.

The vulnerability is local by nature; an attacker would need to mount a corrupted FAT image or otherwise cause the system to remove a directory on such a filesystem. With the EPSS score unavailable, the exploitation probability appears low but not negligible. The CVSS score is unspecified, and the issue is not listed in the CISA KEV catalog, indicating it is not currently a known exploited vulnerability. Nevertheless, the potential for a kernel crash or denial of service warrants timely attention.