Linux Kernel EUVD-2026-32381

The Linux kernel's FAT filesystem driver (covering both vfat and msdos variants) maintains directory hard-link counts via the VFS inode i_nlink field. By POSIX convention, directories start with link count 2 (for '.' and the parent entry) and gain one count per subdirectory via the '..' entry in each child. The rmdir path in fat/dir.c calls drop_nlink(dir) to decrement the parent's link count when removing a subdirectory, but it does so unconditionally without first validating that the count is ≥ 3. A corrupted FAT on-disk image (e.g., crafted using a hex editor or generated by a faulty implementation) can present a directory inode with i_nlink = 2 even if subdirectories are present. When rmdir is called against such a directory, drop_nlink drives i_nlink to 0, which triggers the WARN_ON assertion inside drop_nlink() at fs/inode.c, potentially causing a kernel oops or panic. Affected CPE: cpe:2.3:o:linux:linux_kernel across all supported stable branches from 2.6.19 onward. CWE classification is absent from the NVD entry, but this is best characterized as an improper input validation / integer underflow in filesystem metadata handling.