In the Linux kernel, the ext4 filesystem code incorrectly publishes a jinode pointer before it is fully initialized. A reader can observe a non‑NULL jinode while the corresponding VFS inode still has no mapping, causing the fast commit flush path to dereference an uninitialized pointer and crash. The resulting kernel panic manifests as a denial of service for the entire system.

The vulnerability is present in any Linux kernel that includes ext4 before the patch that initializes the jbd2_inode. Since the CVE payload does not list specific affected versions, all older kernels containing the described code are potentially affected.

The EPSS score of < 1% and the absence of an entry in the CISA KEV catalog suggest a low probability of exploitation, but the consequence of a kernel panic is severe. The fault can be triggered by a write, sync, or fsync operation on an ext4 filesystem, which a local user can perform and which may be escalated by an attacker. Consequently, the risk is considered moderate to high for systems running an affected kernel altogether.