Linux Kernel EUVD-2026-45639

Exploitation requires the system to have a filesystem mounted through the netfs helper layer (AFS, Ceph, CIFS/SMB, 9p, or an fscache/cachefiles-backed mount) and requires an already-issued read subrequest to fail so the un-paused subrequest generation path is reached - the description explicitly ties the defect to behavior 'if an already-issued subrequest fails.' Limiting factors: the code is only present in kernels from the 6.12 series onward that use netfs read-to-pagecache; a host with no netfs-backed mounts is not exposed; and triggering the failure realistically depends on control over, or induced errors from, the backing network filesystem or storage. The CVSS AV:N/PR:N/UI:N claim is not corroborated by the description, which implies a locally-mounted, error-triggered condition rather than direct unauthenticated network attack.

The signals conflict sharply and should be reconciled before prioritization. The CNA CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8) implies trivial remote unauthenticated full-system compromise, but this contradicts the nature of the change: it is a netfs read-path error-handling fix reachable only when a filesystem is actually mounted through netfs and a subrequest fails, which is a local/triggered condition rather than a directly attacker-facing network service. EPSS agrees with the low-real-risk reading (0.17%, 6th percentile), there is no KEV listing and no known POC, and the intelligence tag labels impact as Information Disclosure - not the Availability/Integrity compromise the 9.8 asserts. This is a high-CVSS-but-low-real-risk item: the 9.8 appears to be automated Linux-CNA inflation. Note explicitly: CVSS claims network vector and no privileges, but exploitation realistically requires a netfs-backed mount and the ability to induce subrequest failure, so treat AV:N/PR:N as unverified. Patch it through normal stable-kernel maintenance rather than as an emergency.

An attacker or fault condition that can cause a netfs read subrequest to fail (e.g. a misbehaving or malicious network filesystem server, or induced I/O errors on a mounted AFS/Ceph/CIFS share) triggers the missing pause, causing subsequent subrequests to proceed against an inconsistent request state and potentially return stale or uninitialized page-cache contents to a reading process. No public POC or exploit is known, and the scenario requires an active netfs-backed mount rather than an unauthenticated remote entry point, so real-world exploitability is limited despite the high CVSS.