The vulnerability arises from XFS debug macros that invoke kasprintf to format strings. When a formatted string exceeds the limited size and memory allocation fails, the macros do not handle the null return value. The description lists this scenario as a risk, and it is inferred that such a failure could lead to a null-pointer dereference, possibly resulting in a kernel crash and causing a denial of service.

Linux kernels that include the XFS filesystem code before the patch is merged are potentially affected. The fix was incorporated into commits merged between kernel releases 6.6 and 6.14, so any system running those or earlier kernels that still use the XFS debug paths may be vulnerable.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is likely limited to local kernel execution; an attacker would need to trigger XFS operations that invoke the affected debug macros. The KEV catalog does not list this CVE, further implying limited real‑world exploitation potential. Because the attack vector relies on local code paths within the kernel, remote exploitation is not indicated.