The Linux kernel’s OCFS2 file system contained a use‑after‑free in the ocfs2_fault() routine when a VM_FAULT_RETRY occurs. A concurrent munmap() can free the associated vm_area_struct while ocfs2_fault still holds a reference to it, causing a dangling pointer dereference during subsequent trace_ocfs2_fault() execution. This memory corruption can be leveraged by an attacker to execute arbitrary code with kernel privileges, thereby escalating privileges to root.

All Linux kernel installations that include the OCFS2 file system are potentially affected; no specific kernel version range is provided, so any release prior to the inclusion of the described patch is at risk. Deployments using OCFS2 on any Linux distribution should be considered vulnerable until the kernel is updated.

The flaw receives a CVSS score of 7.8, indicating high severity. The EPSS score of < 1% suggests that current exploitation likelihood is low, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local, requiring an attacker to trigger the fault path within the kernel, typically by provoking concurrent munmap and fault operations on an OCFS2 mounted volume.