The Linux kernel’s nilfs2 file system allows an attacker to invoke the CLEAN_SEGMENTS ioctl with segment numbers that are not validated before the cleaning routine runs. This oversight causes the kernel to acquire the ns_segctor_sem lock, perform repeated printk calls for each invalid entry, and hold the lock long enough for the hung_task watchdog to trigger. The result is that other filesystem operations such as chmod() are blocked for extended periods, potentially causing the system to become unresponsive. The vulnerability is a classic case of improper input validation leading to a local denial-of-service condition when the ioctl is used incorrectly.

Any Linux kernel version that affected, regardless of vendor. The issue resides in the nilfs2 file system support in the kernel and therefore applies to all users of the nilfs2 driver prior to the patch that validates the segment numbers. Vendors are advised to upgrade to the latest kernel release that incorporates the fix found in commit 0789f0a671.

The EPSS score is less than 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would need local file system access to a mounted nilfs2 device and the ability to perform the ioctl. The attack vector is local; remote exploitation requires the attacker to gain local access to the filesystem first. Given the low exploitation likelihood and limited impact scope to the system's performance, the overall risk is moderate, but any denial-of-service scenario can be disruptive to production systems.