The vulnerability is in the ext4 filesystem’s block allocation routine. When a block group bitmap is corrupted, the allocation path may mistakenly request blocks from that group, causing delayed block allocation failures as indicated by the kernel logs. The kernel logs include repeated messages stating "Data will be lost", showing that an inconsistent filesystem state may lead to loss of file data. The weakness is a race condition in the block allocation path (CWE-237), and the analysis also identified potential memory‑leak issues (CWE-401).

All Linux kernel versions that incorporate the ext4 filesystem and have not yet integrated the fixes in commits 9008a58e5dce and 163a203ddb36 are potentially affected. No specific kernel releases are enumerated; therefore, any system running a Linux kernel where ext4 code unmodified by those commits might be vulnerable.

The CVSS score of 5.5 is reported, while the EPSS score remains under 1%, indicating a low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The risk manifests when a block group bitmap becomes corrupted, leading to possible data loss. There is no documented remote exploitation path; the threat vector would likely require an adversary that can induce or discover filesystem corruption, perhaps through hardware failure or local tampering.