The netfs module in the Linux kernel contains a concurrency flaw where updates to the remote_i_size and zero_point fields are performed without holding the i_lock. This omission can corrupt the i_size_seqcount and cause file‑size tearing. The weakness is a mix of improper synchronization (CWE‑362) and improper locking (CWE‑821). The result is an integrity failure where files accessed via netfs may have incorrect sizes or become corrupted.

The vulnerability affects all Linux kernel builds that have not incorporated the recent netfs seqcount fix. The available data lists the generic Linux kernel and the 7.1‑rc1 through 7.1‑rc4 releases. Because no specific version numbers are supplied, any system running a kernel prior to the commit that introduces the i_lock guard around size updates is potentially exposed, regardless of distribution.

The CVSS score of 9.8 marks this as a critical issue, while the EPSS score of less than 1% indicates limited observed exploitation. Based on the description, it is inferred that an attacker would need to mount or otherwise interact with a netfs file‑system, giving rise to a local or privileged access scenario. The vulnerability is not listed in the CISA KEV catalog, meaning no publicly known exploits have appeared. Consequently, the risk of exploitation is low, yet the potential for severe data corruption warrants prompt attention.