The vulnerability arises from the XFS filesystem’s helper function xfs_attr_leaf_hasname returning inconsistent buffer states depending on the outcome of internal read and lookup calls. In some error conditions the function may return a NULL pointer, a valid buffer that is subsequently freed twice, or a dangling pointer that is later dereferenced. These inconsistencies can cause a use‑after‑free or double‑free in kernel memory, potentially leading to data corruption, a kernel panic, or, if an attacker can exercise the failure path, privilege escalation. The weakness is mapped to CWE‑416 and CWE‑825.

All Linux kernels that implement XFS and have not applied the commit that removes or inlines xfs_attr_leaf_hasname are vulnerable. The patches referenced by the CVE include commit hashes 2fbc8421d1db102c0e5458607e042a23a03648b1, 3a65ea768b8094e4699e72f9ab420eb9e0f3f568, 457121c01f609b9934addbb04d5c1ef638c71c61, and 530082df991903f3330354e99e0cb7b05debfa86. Administrators should treat all kernel versions prior to these commits as affected and should upgrade to a distribution‑maintained kernel that incorporates the fix.

The CVSS score of 7.8 indicates high severity. The EPSS score of less than 1% implies a low probability of exploitation in the wild at present. The vulnerability is not listed in the CISA KEV catalog, meaning no publicly known exploits exist. However, because the flaw involves kernel memory management, a successful local or privileged exploit could precipitate a kernel crash or privilege escalation. The most likely attack vector requires local or elevated access that can trigger the internal error path, resulting in a use‑after‑free or double‑free scenario.