The Linux kernel’s netfs module contains a flaw in the handling of the folio->private field during write operations. Under certain conditions netfs_perform_write fails to correctly manipulate this pointer, allowing multiple attachments of private data to accumulate. This results in reference leaks of folio resources, netfs_folio structures, and netfs_group references. Over time these leaks can exhaust kernel reference counters and potentially destabilize the system, leading to a denial of service. The underlying weakness is improper resource management, mapped to CWE‑911.

All Linux kernels that include the unpatched netfs_perform_write routine are affected. The CPE entries identify the 7.1 release‑candidate series (rc1 through rc4) as well as any downstream kernels derived from those releases. The flaw applies to any network‑filesystem implementation that uses this routine, such as NFS and other netfs‑based filesystems, meaning any system that mounts or serves a netfs across the network is potentially impacted.

The EPSS score is below 1 %, indicating a very low likelihood of exploitation in production environments. The CVSS base score of 5.5 denotes moderate risk. Based on the description, it is inferred that the attack vector requires the attacker to trigger repeated write operations over an exposed network filesystem to accumulate the resource leaks that could lead to disruption. No current evidence of exploitation exists, and the issue is not listed in CISA’s KEV catalog.