The vulnerability resides in the erofs filesystem driver when a file‑backed filesystem is mounted with the directio option. A race between the I/O request submit path and the request completion path allows the request structure to be freed while still referenced, triggering a use‑after‑free that results in a kernel panic. The flaw is designated CWE‑416 and does not provide direct code execution; the immediate consequence is a denial of service via a system crash.

All Linux kernels that ship the erofs filesystem prior to the merge of commit 1caf50ce4af096d0280d59a31abdd85703cd995c. Vendors that distribute such kernels—across mainstream distributions—are affected if they expose erofs mounts with the directio option. The issue does not depend on additional kernel options beyond the presence of erofs and a file‑backed mount with directio enabled.

The CVSS score of 7.8 reflects high impact, while the EPSS score of <1% and absence from the KEV catalog indicate a low probability of exploitation. The likely attack vector is local or a user with the privilege to mount an erofs filesystem; the described race requires initiating concurrent I/O operations that exploit the timing between request submit and completion. Because the directio mount option is typically limited to privileged users, an attacker would need at least local authenticated access, or a process already running on the system. No evidence of code execution or privilege escalation is provided in the CVE description, so the vulnerability primarily threatens availability rather than confidentiality or integrity.