The vulnerability arises from the XFS kernel filesystem’s helper function xfs_attr_leaf_hasname returning inconsistent buffer states. When xfs_attr3_leaf_read fails, the helper may return a NULL buffer; if xfs_attr3_leaf_lookup_int returns -ENOATTR or -EEXIST, it returns a valid buffer; otherwise it may return a dangling pointer. Callers that subsequently free or dereference the buffer can trigger use‑after‑free or double‑free conditions, which in kernel space may corrupt memory, cause a kernel panic, or potentially allow elevation of privileges. The weakness is classified as CWE‑825: Improper Release of Resource.

All Linux kernels that provide the XFS filesystem and have not applied the commit that removes the xfs_attr_leaf_hasname helper are potentially vulnerable. The CVE references several commit hashes (e.g., 2fbc8421d1db102c0e5458607e042a23a03648b1, 3a65ea768b8094e4699e72f9ab420eb9e0f3f568, 457121c01f609b9934addbb04d5c1ef638c71c61, 530082df991903f3330354e99e0cb7b05debfa86). Administrators should treat any kernel prior to these changes as affected until a version that incorporates the inline replacement or removal of the helper is installed. No specific version ranges are published, so the safest mitigation is to upgrade to the latest stable kernel supported by the distribution.

The CVSS score of 7.8 indicates a high severity for kernel memory corruption. The EPSS score of <1% suggests that the probability of exploitation in the wild is low at present. The vulnerability is not recorded in the CISA KEV catalog, so no publicly known exploits are known. However, because the issue involves kernel memory management, a successful local exploit could result in a kernel panic or privilege escalation. Based on the description, it is inferred that the attack would likely require local or elevated access to provoke the error path, indicating a local privilege escalation vector.