The netfs subsystem failed to correctly cancel subrequests that could not be prepared, allowing dangling references and queued entries to remain in the kernel’s internal lists. This flaw can lead to unreleased resources, corrupted internal state, and kernel crashes. Because the bug resides in a core I/O subsystem, it is classified as CWE‑772, and the resulting memory corruption or instability can produce a denial‑of‑service or, in the hands of a skilled adversary, a pathway to privilege escalation.

All Linux kernel versions built before the commit that introduced the queueing and termination fix (commit 5366199be46fb5) are affected. Any distribution kernel that has not yet incorporated this change remains vulnerable, regardless of the distribution or the specific kernel release number.

The CVSS score of 9.8 marks this vulnerability as critical, yet the EPSS score of less than 1% indicates a very low current exploitation probability. It is not listed in the CISA KEV catalog. Exploitation requires the ability to trigger failed read requests, typically from a local user with kernel‑level privileges. If successfully invoked, the improper cleanup can cause kernel instability, a denial‑of‑service, or in rare circumstances enable privileged code execution through corruption of kernel state.