The flaw is an improper cursor handling bug in the Linux kernel’s XFS file system. When the btree repair logic revalidates two trees, the first call to the allocation routine clears a cursor that the second call relies on, resulting in an unguarded null‑pointer dereference and a kernel crash. The vulnerability can be triggered by executing the XFS ioctl scrub operation or by injecting errors that cause similar code paths to be exercised. The crash is a denial‑of‑service condition that can bring the kernel, and consequently the entire host or the affected XFS mount, to an unresponsive state. The CVE description does not explicitly state the required privilege level, but the ioctl path typically requires local access and may be restricted depending on system configuration.

All Linux kernel releases that contain the buggy XFS btree repair code are impacted. The advisory does not list precise version ranges, but the issue was discovered in recent kernel revisions before the patch was merged. Any system running a kernel that has not been updated to include the commit that removes the null‑pointer dereference is likely vulnerable.

The CVSS score of 5.5 indicates a medium severity, with potential impact for a local user or, if the firmware permits, any actor that can invoke the XFS ioctl or create the specific corruption conditions required. The EPSS score is < 1%, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, suggesting low current exploitation activity. However, because the crash occurs in a routine that can be invoked by user space, a local attacker who has permission to run the ioctl or who can generate the precise file‑system corruption could realistically trigger the fault.