The Linux XFS filesystem contains a flaw in which the xfarray and xfblob destructors are invoked without confirming that the pointer is valid. This null pointer dereference can corrupt kernel memory or crash the kernel, allowing an attacker to gain kernel‑level execution or cause a denial of service. If an attacker can cause the buggy destructor path to run, the kernel may crash or an attacker could gain execution at kernel privilege level, leading to denial of service or privilege escalation.

All Linux kernel releases that incorporated the buggy XFS logic before it was patched are impacted. The CVE data does not specify exact version numbers, so any system running those kernels with XFS support is vulnerable.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need to trigger XFS file operations that exercise the destructor paths, implying a local or privileged access requirement. If unpatched, the risk remains substantial; patching mitigates the vulnerability.