The Linux kernel contains an issue in the netfs subsystem where the function netfs_create_write_req() conditionally skips the caching mechanism when the fscache cookie is disabled. However, during asynchronous cache object creation this check may execute before the necessary cache structures are fully initialized, resulting in the call to fscache_begin_write_operation() being omitted. This omission can lead to write operations not being properly cached or synchronized, potentially causing data loss, corruption, or inconsistent file system state. The vulnerability arises from a missing or improper check in the code path that handles cache creation. It represents an integrity issue rather than a classic remote code execution flaw.

All Linux distributions that ship the open-source Linux kernel without the recent patch. The affected code resides in the netfs module of the kernel, which is part of the core OS and is used by NFS and other network file system implementations.

There is no known public exploitation or evidence of attackers weaponizing this defect. With a CVSS score of 9.8, this vulnerability represents a high severity risk. The EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog, which indicates a low likelihood of active exploitation. Nonetheless, the defect introduces a risk of data loss or corruption in environments that rely on netfs caching, particularly when asynchronous cache creation is in use. Administrators should consider the impact of potential integrity failures in critical applications that depend on accurate file system caching.