The vulnerability arises because the application thread can add new folios to a rolling buffer while the collector thread simultaneously examines or clears that same buffer. This race can cause the collector to work with an incomplete or missing folio, potentially leading to kernel panics or corrupted memory. The fix changes the loader to bring all desired folios into the buffer upfront, eliminating the concurrent modification issue. The primary impact is a possibility of denial of service or data corruption if the race condition is triggered during normal operation.

All Linux kernel releases that include the rolling buffer implementation for netfs prior to the fix in commit 8c9b3394 are affected. This applies to every distribution that ships one of those kernel versions, as the vulnerable code resides in the core kernel.

No CVSS score is available and the EPSS score is unavailable, so the exact severity and likelihood cannot be quantified from the available data. The issue is a race condition (CWE‑368) that is internal to the kernel and does not require privileged input. While an attacker could try to trigger the race with concurrent file operations, no public exploit has been reported. The risk is considered low to moderate under typical workloads but could be serious in environments that run heavy or concurrent network filesystem operations.