A flaw in the Linux kernel’s XFS file system recovery path causes a release operation to be performed on a dangling pointer when attribute recovery fails to obtain an inode reference. This results in memory corruption that can trigger a kernel crash or panic, compromising system availability and potentially exposing the machine to additional instability. The issue is a classic use‑of‑invalid‑pointer scenario, classified as a memory management flaw (CWE‑825).

All Linux kernel releases that include the XFS file system are potentially impacted, as the flaw resides in core XFS module code. No specific version range is listed, so any installation using an unpatched kernel remains at risk until the patch is applied.

The severity of the flaw is significant, with a CVSS score of 7.8, and the EPSS score indicates a very low probability of exploitation (<1%). It is not listed in the CISA KEV catalog. The likely attack vector is local, inferred from the description: the vulnerability is triggered during XFS attribute recovery, which could be induced by intentional filesystem corruption or disk errors. Exploitation would require an attacker to create the fault condition, which may be possible through malicious filesystem manipulation or physical media compromise. Due to the potential for system downtime, administrators should treat this as an urgent risk even without a publicly available exploit.