The Linux kernel’s netfs subsystem contained a race condition where the iterator used to walk the subrequest list during retry operations did not properly barrier against concurrent additions. If a thread adds a subrequest entry while another thread is already traversing the list, the traversal can observe an entry that is not fully initialized. Processing this incomplete entry may trigger a kernel panic, causing the entire system to reboot. The effect is a denial‑of‑service in the form of a kernel crash triggered by the netfs subsystem.

Vendors: Linux kernel. The affected product is the Linux kernel itself. Specific affected versions are not listed in the advisory; any kernel version that predates the commits that introduced the fix may be impacted. System administrators should verify that their running kernel contains the commit identifiers 5c6ce05e406520290c1d89da97fb3cd70c09137d or be47c047250671c9225c0319ca4695be9b391c59.

The CVSS base score of 9.8 indicates critical severity, while the EPSS score of < 1% reflects an extremely low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no publicly known exploits. It is inferred that an attacker would need local or privileged access to perform netfs operations in order to trigger the race; a remote attack is not proven by the available information.