The vulnerability originates from the erofs filesystem’s previous inclusion of an fscache backend that was intended to enable lazy pulling of images. This backend introduced an unintended hard dependency on the netfs subsystem, creating a rigid and inflexible caching hierarchy within the kernel’s architecture. The patch announcement notes that this feature has been deprecated for almost two years and was removed to avoid the structural problems it introduced. The description does not provide a specific attack vector or evidence that an attacker could gain code execution or other privileges; it merely highlights a flaw in design rather than a directly exploitable weakness.

Affecting the Linux kernel, specifically the erofs filesystem implementation. Exact kernel version coverage is not listed, but the fix is slated for merge into Linux kernel 7.2, implying earlier releases that enable fscache are potentially impacted. Toolchains and runtimes that rely on erofs, such as the Nydus container runtime, may experience functional changes when the backend is removed.

No CVSS score is provided, and the EPSS value is unavailable. The vulnerability is not included in the CISA KEV catalog, indicating that no publicly known exploits exist at this time. Consequently, the risk of exploitation is unclear and likely low, as the patch merely removes an unused dependency rather than introducing new attack vectors. Nevertheless, systems that implement erofs and interact with netfs should verify correct operation after updating the kernel. The limited information suggests no active exploitation is documented.