Based on the description and commit history, the bug lies in netfs_release_folio() where the zero_point offset, which marks the point after which the client can safely assume the server will return zeroed data, is incorrectly set to the local i_size instead of the remote_i_size when uncommitted pagecache data extends beyond the released folio and the server’s end‑of‑file lies within that folio. This flaw can cause reads beyond the actual remote file size to be treated as successful zero reads, resulting in stale or zeroed data being returned to the application and thus violating data integrity. The underlying weakness is a classic buffer or pointer error (CWE‑805).

All Linux kernel versions that contain the unpatched netfs CIFS/SMB client code path, namely any kernel older than the commit that introduced the fix (4543a4d). Affected users include systems that mount CIFS shares with the default cache options and rely on the standard netfs filesystem support; the advisory does not list specific kernel releases, so any distribution with an unpatched kernel before the commit is potentially impacted.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1 % points to a very low likelihood of exploitation. The vulnerability is not in the CISA KEV catalog. The likely attack vector is local or via privileged file system operations on CIFS shares, as the flaw requires writing and reading to a CIFS share to cause the local i_size to exceed the remote_i_size. An attacker would need the ability to manipulate file sizes on the target system to trigger the bug, so it is not a public remote exploit.