The vulnerability exists in the Linux kernel’s squashfs implementation. A corrupted index look‑up table can produce a negative metadata block offset that is subsequently passed to squashfs_copy_data. The negative offset results in an out‑of‑bounds memory access, triggering a general protection fault. Failure to detect this condition can cause the kernel to crash, effectively denying service to processes requiring access to a malformed squashfs filesystem.

All Linux kernel distributions that include the standard squashfs module are affected. The exact version range is not specified, but any kernel with the unpatched squashfs code is potentially vulnerable. Devices or systems that mount or access squashfs images, such as embedded systems or container images, should examine their kernel release for the fix.

CVSS scoring indicates a moderate severity (6.6). The EPSS score is below 1%, suggesting a low likelihood of exploitation. The vulnerability is not listed in the KEV catalog. Exploitation would likely require an attacker to supply a crafted squashfs image with an invalid index that the kernel processes, making the attack vector local or requiring privileged mounting. Overall, the risk is moderate, but the impact of a kernel crash warrants timely remediation.