A defect in the Linux kernel cachefiles module causes the error pointer returned by vfs_mkdir() to be ignored when the operation fails, resulting in a zero error code and an ERR_PTR(0) value that is interpreted as NULL. This misreporting makes callers believe that the directory creation succeeded when it did not, potentially leading to logic errors, incorrect assumptions about the file system state, and subsequent operations on a non‑existent path without triggering proper error handling. The vulnerability does not provide an attacker with direct code execution or data ex does undermine the reliability of storage operations within the kernel.

All Linux kernel implementations that include the cachefiles module are affected by this bug. The issue existed before the patch commit referenced in the advisory, which introduced a fix. Any system running a kernel version older than that commit, especially custom or embedded builds that incorporate the cachefiles module, is potentially impacted. The exact version range is not specified by the CNA, so a blanket upgrade policy for all kernel versions containing the cachefiles module will mitigate the risk.

The CVSS score of 5.5 places the vulnerability in the medium severity band, reflecting its limited scope to error reporting rather than direct system compromise. The EPSS score is <1%, indicating a very low likelihood that the flaw will be actively listed in the CISA KEV catalog. Explo‑creation failure that is not correctly reported, a scenario that is unlikely in typical workloads. Even so, the resulting false success state can lead to cascading system instability or subtle logical errors, so the overall risk remains moderate and warrants timely remediation.