The vulnerability arises from an undefined shift operation in the GFS2 filesystem code when an exhash directory has a depth of zero. The calculation index = hash >> (32 - dip->i_depth); fails when i_depth equals zero, causing a shift of 32 bits and undefined behaviour. This flaw can lead to memory corruption or a kernel panic, effectively resulting in a denial‑of‑service condition. The attack is likely local or requires privileged access to manipulate GFS2 directory structures, as the code that triggers the bug is only executed during filesystem operations. The fault is a weakness in input validation and calculation logic, which can be exploited when an attacker forces the depth to an illegal value.

Affected systems encompass all Linux kernel releases that contain the GFS2 filesystem implementation where this bug exists. No specific version ranges are documented in the available data, indicating that any kernel incorporating the unpatched code path could be vulnerable. Administrators should assess whether their installations use GFS2 and if they run a kernel version before the identified commit.

Risk and exploitability assessment shows a CVSS score of 5.5, placing the vulnerability in a moderate severity range. The EPSS score is less than 1 %, implying a very low current exploitation probability, and the issue is not listed in CISA’s KEV catalog. The primary vector remains a local, privileged attack; however, if a process with the ability to perform privileged filesystem operations is compromised, the adversary could trigger a crash. The updated kernel mitigates the undefined behavior by validating depth values in gfs2_dinode_in() and recalculating the depth with ilog2().