A logic error in the Linux netfs subsystem causes a dirty flag on a folio to remain set after all modified data has been removed by a truncate operation. When that folio is later accessed through mmap, the kernel attempts to read missing data while expecting a netfs_folio structure that has already been discarded, leading to a kernel oops. The result is a system crash that restores availability only after a reboot, but does not grant an attacker code execution.

Linux kernels that include the netfs module prior to the commit that introduces folio_cancel_dirty() in netfs_invalidate_folio are vulnerable. The fix is part of upstream releases after commit 156ac2ec2ee77c44c4eb7439d6d165247ba12247 and is therefore missing from all earlier kernel versions that have not applied this change.

The CVSS score of 5.5 places the flaw in the moderate range, while the EPSS probability of less than 1 % and its absence from the CISA KEV catalog indicate a low likelihood of active exploitation. An attacker would need local or privileged access to perform a streaming write to a netfs file system, truncate the file to remove the dirty range, and then trigger an mmap read. Because the required actions affect only local file systems and the kernel crash does not expose remote code execution, the practical risk is less than that of network‑directed high‑severity vulnerabilities.