The Linux kernel flaw removes a test that avoids truncating files that are signed with fs‑verity when fs‑verity is not enabled in the kernel. Filesystems that contain fs‑verity metadata can therefore be truncated by users who otherwise could not affect those files. This flaw permits an attacker to modify or delete the contents of files that are intended to be tamper‑evident, undermining data integrity. The impact is limited to modification of data and potential service disruption; it does not directly allow remote code execution but can lead to corrupted data or denial of service if critical files are affected. The underlying weakness is an improper authorization check.

All Linux kernel versions that carry the buggy code change, for every mainstream distribution that ships the kernel from the official source tree. Specific kernel version information is not provided, so any kernel that has not yet been patched for this regression is considered affected.

The flaw requires local kernel access; a user with permission to truncate files on the affected filesystem can exploit it. There is no known remote exploitation path. The EPSS score of <1% indicates a low likelihood of exploitation in the general population. The CVSS score of 5.5 represents a moderate severity. The vulnerability is not listed in the CISA KEV catalog, implying it has not been observed in known exploits. The attack vector is most likely local, based on filesystem access permissions, and the risk depends on the presence of sensitive fs‑verity protected data on the system.