The flaw resides in the sysfs_update_group routine of the Linux kernel. When the group directory already existed and create_files() fails (for example, due to memory exhaustion), an internal call to kernfs_remove() deletes that existing directory without any protection. The directory is removed silently and left empty, and may be recreated only when the update operation is retried. Since the directory could contain critical sysfs entries used by drivers or user‑space utilities, its unintended removal can temporarily break functionality or cause drivers to fail to initialize, leading to service disruption. The vulnerability is a moderate severity bug as reflected by a CVSS score of 5.5.

All Linux kernel implementations that contain the buggy sysfs_update_group code before the recent patch. The exact kernel revisions are not enumerated in the provided data, but the fix is included in the latest kernel development tree and will be released in forthcoming stable versions. Systems running any kernel version prior to that fix are potentially affected, regardless of distribution or architecture.

The EPSS score is less than 1%, indicating that widespread exploitation is unlikely. The attack scenario requires local access to the kernel, typically through a privileged process or a vulnerable driver that triggers sysfs_update_group. An attacker with sufficient privileges could force the update path to fail, resulting in the silent removal of groups. The impact is not permanent—re‑retrying the operation will repopulate the directory—but repeated failures could cause intermittent service disruptions. The vulnerability is not listed in the CISA KEV catalog.