A use‑after‑free error occurs in the Linux f2fs file system when the superblock’s page counter is decremented during the write end I/O callback while the file system is unmounting. The bug causes the kernel to dereference the node inode after it has been cleared to NULL, resulting in a NULL pointer dereference that triggers a kernel panic. This produces a complete denial of service on the affected system. Based on the description of the unmount operation, it is inferred that a user with permission to unmount the filesystem would need to trigger the race condition.

All Linux kernel releases that contain the unpatched f2fs logic before the 2026‑31715 fix. No specific version range is supplied, so any kernel offering f2fs and including the legacy write‑end‑io counter decrement is potentially vulnerable.

The vulnerability is a local use‑after‑free that, by inference, requires a privileged user capable of initiating an unmount of an active f2fs volume. Exploitation would need local access to the device and the ability to perform the unmount sequence, limiting its practicality. No public exploits are known and it is not listed in the CISA KEV catalog. Because the flaw can halt the system, the impact remains severe, especially on critical servers that cannot tolerate downtime.