An out-of-bounds write (CWE-1284 and CWE-787) occurs in the Linux kernel when the OCFS2 file system performs a copy_file_range operation on a corrupted OCFS2 filesystem mounted on a loop device. The function ocfs2_write_end_inline writes 4086 bytes beyond the inode block buffer because the on‑disk id_count field is trusted without validation, allowing it to exceed the physical inline data capacity. This overflow corrupts an adjacent freed page, leading to memory corruption that could overwrite kernel data structures or code and potentially result in denial of service or arbitrary code execution.

Systems that run a Linux kernel with OCFS2 support and mount OCFS2 volumes are affected. The CVE does not list version ranges, so any kernel build that contains the vulnerable ocfs2_write_end_inline implementation and has not been patched is at risk, especially when the filesystem is corrupted.

With a CVSS score of 7.8, the vulnerability is classified as high severity. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires local or privileged access to create or exploit a corrupted OCFS2 filesystem that triggers the copy_file_range splice. An attacker who can mount such a filesystem or perform that operation could provoke the out-of-bounds write, corrupting kernel memory and potentially escalating to higher privileges. Given that the flaw resides in kernel code, the impact remains significant if exploitation conditions are met.