Based on the description, the vulnerability is a logic flaw that allows the ext4 file system to allocate blocks beyond the 32‑bit block number limit when handling indirect‑mapped files in a mixed extent/indirect environment. The flaw stems from an oversight in the ext4_mb_scan_groups() routine, where an unsupported group may be selected, resulting in wraparound of block numbers and potentially corrupting file system metadata. The potential impact is data corruption or loss on the affected partitions.

The affected platforms are Linux systems running any kernel that contains the ext4 file system with the flawed allocation logic prior to the addition of the safety clamp in ext4_mb_scan_groups(). The CPE data indicates that copies of the Linux kernel, any version without the fix, are vulnerable. No specific distribution names are disclosed, so perform a kernel version audit to identify vulnerable systems.

The CVSS score is 9.8, indicating a high severity. The EPSS score is less than 1%, suggesting a low likelihood of exploitation. The vulnerability is not included in the CISA KEV catalog. Based on the description, the likely attack vector requires local write access to an ext4 file system or the ability to create a mixed extent/indirect file system, which would allow an attacker to trigger the allocation error and potentially corrupt the data.