This flaw allows a FUSE daemon to issue FUSE_NOTIFY_STORE and FUSE_NOTIFY_RETRIEVE operations on directory objects that use the FOPEN_CACHE_DIR option. Such directories store data in the kernel’s page cache for internal caching, and user space should not have the ability to write or read this cache. Before the patch, the kernel accepted the requests, treating the supplied data as valid page cache contents, which could trigger WARN_ON when the cache became corrupted. The current fix causes the kernel to reject all non‑regular‑file notify requests with an "-EINVAL". The effect of the original issue is the potential corruption of the page‑cache structure, which could lead to unstable file‑system operations or a kernel panic, thereby causing a denial of service.

All Linux kernel releases that do not include the patch, including every current and previous major release represented in the CPE list, and specifically the 7.1 release candidates RC1 through RC6. Any distribution running a kernel from those versions without the latest update would be vulnerable.

The CVSS score of 5.5 classifies the vulnerability as moderate. The EPSS score of less than 1 % indicates a very low probability of exploitation in the immediate future, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation would require an attacker to control a FUSE daemon or otherwise inject FUSE_NOTIFY_STORE or FUSE_NOTIFY_RETRIEVE requests destined for a directory with FOPEN_CACHE_DIR enabled. Because the vulnerable operation is limited to manipulating page‑cache contents and does not grant arbitrary code execution, the confirmed impact remains a potential denial of service rather than privilege escalation.