The Linux kernel issue arises when a FUSE filesystem receives an O_APPEND direct‑write operation. The implementation captures the original offset before the generic write checks, but the generic logic moves the file pointer to the end of file for O_APPEND writes. After the write completes, the kernel invalidates a stale range based on the original offset, leaving the tail page that crosses the old EOF still cached. Consequently, concurrent readers can fault back stale data from that cached page and receive incorrect file contents, resulting in visible data inconsistency or corruption.

Any system running a Linux kernel that supports FUSE, before the patch that remediates the write‑position handling. Specific versions are not listed in the advisory; therefore all kernel releases lacking the fix are potentially affected.

Exploit likelihood is low (EPSS < 1%) and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local; it requires an attacker who can open a file for O_APPEND direct write on a mounted FUSE filesystem. While no remote code execution is enabled, an attacker can corrupt file contents, potentially affecting downstream applications that rely on the affected data. The absence of a CVSS score limits precise severity assessment, but the combination of low exploitation probability and data‑corruption impact suggests a moderate risk that should be mitigated promptly.