In xfs_inode_item_push() and xfs_qm_dquot_logitem_push(), the AIL lock is released in order to perform buffer I/O. If the log item that was protected by the lock is reclaimed by background processes such as the reclaim thread or the dquot shrinker, it can be freed while a subsequent spin_lock() call later attempts to access lip->li_ailp. This dereferences a freed pointer, creating a classic use‑after‑free error that can corrupt kernel memory, result in a kernel panic, or allow an attacker to execute arbitrary code with ring‑0 privileges.

All Linux kernel releases that include the XFS filesystem and contain the buggy push callback functions before the fix. The issue is addressed by kernel commit 19437e4f7bb909afde832b39372aa2f3ce3cfd88 and any later commits that incorporate it. Linux kernel users on earlier versions are vulnerable.

The CVSS score of 7.8 classifies this flaw as high severity. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, meaning no publicly documented exploitation has been reported. The likely attack vector is local; an attacker would need the ability to write to an XFS filesystem to trigger the race between the AIL lock release and the background reclaim, potentially leading to a kernel panic or privilege escalation.