The vulnerability lies in the Linux kernel’s netfs and AFS write paths, where a write operation can be silently skipped when lock contention occurs and the WB_SYNC_NONE flag is set. The fix returns 1 for a skipped write, propagates the skip to afs_single_writepages(), and re‑marks the inode. If this path were exploited, a legitimate write might never reach disk, causing data loss or corruption—a medium‑severity impact on data integrity that maps to CWE‑367, improper locking. The description notes that the issue is theoretical for directories, as current lock serialisation makes the scenario unlikely.

All Linux kernel releases that expose the netfs/afs writepage routines without this patch are affected. The CVE record does not specify affected versions, so any kernel prior to the commit that introduces the fix remains vulnerable. System administrators should verify the kernel version and whether the commit series has been applied.

The CVSS score of 5.5 categorises the risk as moderate. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild. Because the scenario requires lock contention and specific write conditions, coupled with the lack of a known public exploit, the likelihood of real‑world attacks is low, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the potential for data loss warrants patching if the kernel is in use.