The vulnerability in the Linux kernel occurs when the OCFS2 file system performs a copy_file_range operation on a corrupted OCFS2 filesystem mounted on a loop device. The function ocfs2_write_end_inline writes 4086 bytes past the end of the inode block buffer because the on-disk id_count value is not bounded by the physical inline data capacity. This out‑of‑bounds write corrupts an adjacent page in memory, which KASAN reports as a use‑after‑free. The corruption could overwrite kernel data structures or code, potentially leading to denial of service or arbitrary code execution.

The affected products are Linux distributions that ship a Linux kernel with OCFS2 support. Any system running a kernel that includes the OCFS2 file system drivers and that mounts OCFS2 volumes, particularly if the filesystem has been corrupted, is at risk. No specific kernel version ranges are listed in the CVE data; therefore every kernel implementation of the affected code that has not yet been updated with the patch is potentially vulnerable.

The CVSS score is not provided; EPSS is not available, and the vulnerability is not in the CISA KEV catalog. The attack likely requires local access to the affected machine to create or exploit a corrupted OCFS2 filesystem that triggers the copy_file_range splice. An attacker who can mount such a filesystem or perform the copy_file_range operation may be able to provoke the out‑of‑bounds write, thereby corrupting kernel memory. Because the bug lies in kernel code, the risk of exploitation is significant if the attacker can influence the kernel’s I/O path.