The Linux kernel’s netfs subsystem had a flaw in netfs_read_gaps that left stale data gaps in the buffer because the memory was not cleared after a successful read. When the client subsequently streamed data back to the server, this stale content was written to the filesystem, potentially overwriting newer data. The defect therefore allows data that was not intended to be persisted to be written to a file, creating a corruption or data integrity issue.

All Linux kernel releases that include the netfs module and have not yet incorporated the upstream fix identified by commit hashes 2a62fe6, 512eaf0, or 8db55c5 are affected. Any distribution shipping a kernel before these commits is vulnerable, and the flaw is tied to network file system operations performed through the kernel’s netfs interface, which may be invoked by NFS or similar protocols.

With a CVSS v3.1 score of 4.4, this vulnerability is assessed as moderate. The EPSS score of <1% indicates a low probability of exploitation at present, and the CVE is not listed in the CISA KEV catalog. The bug remains a data integrity issue: it could lead to stale data being written back to the filesystem when a netfs client performs a short‑or‑EOF read, potentially overwriting newer content. Exploitation would require an attacker to manipulate a netfs client or server to trigger the stale data path, so the threat is primarily confined to host or networked environments that use the unpatched netfs module.