A race condition exists in the XFS unmount routine when the Allocated Inode List (AIL) is flushed while background reclaim and inode garbage collection are still active. The concurrent execution can cause dirty or newly inserted inodes to be freed or overwritten, leading to corrupted inode metadata and potentially a kernel crash, so the primary impact is data integrity loss or a kernel panic. This weakness involves both a race condition (CWE‑366) and a potential use‑after‑free scenario (CWE‑416) during the unmount process.

The flaw is embedded in the Linux kernel’s XFS module. Any system running a kernel version before the patch that mounts an XFS filesystem and subsequently unmounts it is potentially affected. The exact vulnerable kernel version numbers are not listed, so all kernels preceding the fix are considered susceptible.

Only privileged or root users who can issue an unmount can trigger the race, so the attack surface is limited to system administrators or malicious processes with elevated rights. The CVSS score is 7.8, the EPSS score is below 1 %, and the vulnerability is not in CISA’s KEV catalogue, indicating a moderate to high likelihood of exploitation but an appreciable impact if triggered. The root cause is a race condition (CWE‑366) and a use‑after‑free scenario (CWE‑416) that can lead to denial of service or integrity failure when an XFS filesystem is unmounted during active background reclaim or inode garbage collection.