During a read operation on a netfs‑mounted filesystem, the function netfs_read_to_pagecache() failed to halt the creation of new subrequests when an already‑issued subrequest encountered a failure. This oversight allowed the kernel to continue scheduling further subrequests indefinitely, potentially exhausting kernel buffers and other resources. An attacker who can provoke multiple failed subrequests – for example by manipulating netfs traffic or triggering errors on the filesystem – could degrade system performance or render the system unresponsive. The flaw is classified as a critical kernel bug with a CVSS score of 9.8. The description does not explicitly state the attacker’s ability to trigger the failure, so any claim about the attacker's capability remains inferred.

All versions of the Linux kernel that contain an unpatched netfs subsystem are vulnerable. The affected releases include all kernel versions prior to the patch and include the 7.1 release candidates (rc1 through rc4) as listed in the CPE strings. System administrators should verify the installed kernel against the latest official releases to determine if the netfs_read_to_pagecache patch has been applied.

The high CVSS score indicates that an exploit could produce a denial‑of‑service condition affecting system availability. The EPSS score of less than 1 % suggests that the likelihood of this vulnerability being exploited in the wild is low at the present time, and it is not listed in CISA's Known Exploited Vulnerabilities catalog. The vulnerability resides at kernel level, so the attack vector is likely local or at most privileged; this assessment is inferred from the kernel‑level nature of the flaw. No public exploit has been disclosed, yet the severe impact warrants prompt remediation.