The vulnerability arises from a missing buffer-head release in the ext4 file system’s replay routine. When ext4_fc_replay_inode() encounters certain error paths, it jumps to an out label that leaves the iloc.bh reference unreleased, leading to a cumulative kernel memory leak. Because the function also incorrectly reports success instead of propagating errors, the system may continue performing operations while the leak progresses. Over time, this unchecked consumption can exhaust kernel memory pools, trigger the OOM killer, or destabilize the system, presenting a denial‑of‑service risk.

All installations of the Linux kernel that implement the ext4 file system and have not incorporated the commit that adds the out_brelse label are vulnerable. The fix is contained in commit 0892f12cd49fde5d5db68137923db107f894f3a3, and any kernel build preceding that commit is considered at risk.

The advisory does not publish a CVSS or EPSS score, and the issue is not listed in the CISA KEV catalog. Based on the description, exploitation would involve inducing one of the ext4 error paths (such as a metadata handling failure) to trigger the leak. This typically requires local interaction with the filesystem, though an attacker could leverage an auxiliary vulnerability to gain such access. If the error paths are repeatedly activated, kernel memory exhaustion could ensue, potentially causing a system‑wide outage.