The vulnerability manifests as a use‑after‑free bug in the XFS filesystem component of the Linux kernel, occurring when the code dereferences a freed pointer while checking block ownership in a B‑tree. This flaw can corrupt kernel memory and lead to a kernel crash, potentially causing denial of service. While kernel memory corruption could be leveraged for arbitrary code execution in theory, the CVE description does not detail a confirmed execution path, so such an outcome requires additional conditions not specified in the report.

The flaw affects any Linux kernel that includes the XFS filesystem and does not contain the patch that fixed the temporal ordering issue in the use‑after‑free. No specific downstream version numbers are listed, so all kernels lacking the commit that performed the fix are considered vulnerable.

The CVSS score of 7.8 indicates a moderate‑to‑high severity, but the EPSS of <1% suggests a low likelihood of active exploitation. The flaw is not listed in the CISA KEV catalog. Because the vulnerable code resides in the filesystem driver, the most likely attack vector is local and requires manipulation of XFS file system data by a privileged or compromised process.