In the Linux kernel a failure in netfs_write_begin() caused a VM_BUG_ON_FOLIO() assertion in mm/filemap.c that results in a kernel BUG and an oops. The flaw is a flaw in the kernel’s handling of network filesystem writes (CWE-832). When triggered, the kernel crashes, interrupting all processes and effectively denying service. There is no documented remote execution or privilege escalation path; the impact is a local denial of service caused by a kernel crash.

All Linux kernel releases before the netfs_write_begin() bug fix are impacted. The defect applies to any system that mounts a network filesystem that uses the netfs_write_begin() path, such as Ceph. Other network filesystems built on netfs may also be affected.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% signals a very low likelihood of real‑world exploitation. The vulnerability is not listed in CISA’s KEV catalog. An attacker would need to trigger a kernel BUG through a write operation to a network filesystem. The likely attack vector is local access or an application with write permission. The path is not trivial and the exploit would result in a kernel crash rather than arbitrary code execution. Overall, the risk is moderate, with a low probability of exploitation and a foreseeable denial‑of‑service impact.