The flaw stemmed from mishandled buffer returns in the xfs_attr_leaf_hasname routine. Depending on the error code, the function returned either a valid, a NULL, or a dangling buffer. Subsequent releases by callers could attempt to free or dereference these buffers, creating classic use‑after‑free or double‑free conditions. An attacker with sufficient local access could trigger such an error path to cause a kernel panic or, if properly exploited, gain elevated privileges. The weakness is rooted in improper resource management and falls under the typical use‑after‑free and invalid free classes of vulnerabilities.

All Linux kernel releases that incorporate the XFS filesystem and use the xfs_attr_leaf_hasname helper. Specific patch levels are not listed, so any kernel prior to the commit that removes the function is potentially vulnerable. The absence of version data means administrators should treat all current unpatched XFS‑enabled kernels as affected until a patch is confirmed applied.

The EPSS score is unavailable and the vulnerability is not yet listed in CISA’s KEV catalog, but the nature of the flaw – a kernel‑level memory corruption that can be triggered by an error path in filesystem operations – suggests a high severity CVSS. The attack would require local access or a privileged process to trigger the error condition, making the vector appear as a local privilege escalation scenario. The lack of a publicly known exploit at this time does not diminish the potential risk, especially for systems running unpatched kernels with XFS mounted.