In the Linux kernel a failure in netfs_write_begin() caused a VM_BUG_ON_FOLIO() assertion in mm/filemap.c that results in a kernel BUG and an oops. The flaw is a flaw in the kernel’s handling of network filesystem writes (CWE‑832). When triggered, the kernel crashes, interrupting all processes and effectively denying service. There is no documented remote execution or privilege escalation path; the impact is a local denial of service caused by a kernel crash.

All Linux kernel releases before the patch commit that fixed netfs_write_begin(). The affected build is part of the upstream Linux kernel; no specific vendor or version is listed beyond the Linux kernel itself. The defect applies to any system that mounts a netfs-based filesystem such as Ceph, Gluster, or other network filesystems that traverse the netfs_write_begin() path.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% signals a very low likelihood of real‑world exploitation. The vulnerability is not listed in CISA’s KEV catalog. An attacker would need to trigger a kernel BUG through a write operation to a network filesystem, which typically requires local access or an application with write permission. The path is not trivial and the exploit would result in a kernel crash rather than arbitrary code execution. Overall, the risk is moderate, with a low probability of exploitation and a foreseeable denial‑of‑service impact.