In the Linux kernel, the netfs subsystem’s netfs_read_folio() function fails to pause for ongoing writeback operations. Because it proceeds without confirming that the writeback has finished, it may rely on a stale dirty flag and a folio‑private pointer that could already have been cleared by the collector. This race condition can result in memory corruption or a use‑after‑free scenario in kernel space, affecting the integrity of the operating system.

Linux kernel installations that have not incorporated the recent commit fixing the netfs_read_folio() wait. All distributions distributing the unpatched kernel are affected, especially when network filesystems such as NFS or SMB are in use.

The vulnerability carries a CVSS score of 7.8, indicating high severity for integrity. EPSS is below 1 %, suggesting a low probability of exploitation at present. It is not listed in CISA’s KEV catalog. The likely attack vector involves a process that performs operations on a network filesystem while a writeback is in progress; the inferred attack would exploit the race condition by triggering concurrent read and writeback actions.