The NFS subsystem in the Linux kernel incorrectly counts the entire folio size for each write request added to the commit list, rather than only the pages actually covered by that request. When a large folio is split into many small NFS write requests—such as with pNFS flexfiles or wsize‑limited splitting—each request adds the full folio size to the writeback accounting. This over‑counting inflates the global NR_WRITEBACK/WB_WRITEBACK counters by a factor equal to the number of sub‑requests per folio. The resulting accounting inflation can drive the dirty or writeback thresholds beyond their limits, forcing the kernel’s sync machinery and all NFS server threads onto a hard‑throttle path. Although the bug has been fixed in recent kernel commits, any system running a kernel that still contains the flaw is vulnerable to a denial of service that can affect all activities on the host, not just NFS operations.

The vulnerability applies to the Linux kernel’s NFS implementation. All kernel releases that have not incorporated the patch commit are affected, regardless of distribution. Because the CVE does not specify exact version ranges, any system running a kernel older than the referenced commits is potentially at risk.

No known exploitation code is publicly available, and the EPSS score is <1%, indicating a very low likelihood of exploitation. The CVSS score of 5.5 marks the vulnerability as moderate severity. The likely attack vector is any entity that can drive large, frequent NFS write operations—such as a malicious or misbehaving NFS client or an attacker who controls write access to an NFS share. The resource exhaustion caused by the inflated accounting can throttle the entire system, even affecting unrelated services. Because the vulnerability is fixable through a kernel update, the likelihood of exploitation is reduced once a kernel with the patch is deployed.