When an ocfs2 inode is read, the Linux kernel does not verify that the reported i_size fits within the actual inline data capacity. A corrupted filesystem can record an i_size that greatly exceeds the inline buffer length, causing the directory iterator to process data beyond the boundary. This out‑of‑bounds read triggers a use‑after‑free when the code later dereferences freed memory during directory entry processing. The resulting kernel memory corruption may allow an attacker to influence kernel behavior, but the description does not explicitly confirm arbitrary code execution.

All Linux kernel releases prior to the commit that adds the i_size validation check in the ocfs2 filesystem driver are vulnerable. The issue resides in the ocfs2 filesystem module, which is part of the standard Linux kernel. Systems that load the ocfs2 module or mount ocfs2 filesystems on vulnerable kernels are affected, regardless of distribution.

CVSS score of 7.8 and the EPSS score of <1% indicate that exploitation is unlikely, and the vulnerability is not listed in the CISA KEV catalog. To exploit the flaw, a corrupted ocfs2 inode must be accessed; based on the description, this could lead to kernel memory corruption and potentially privilege escalation, but the actual exploitability remains theoretical. Remote exploitation without filesystem manipulation is improbable.