The flaw in the Linux kernel’s EROFS implementation allows an attacker to supply a specially crafted image containing a valid volume label. When the kernel processes the label, an early return is triggered in a way that the kernel fails to release internal folio references. This results in leaks of kernel memory references that could expose sensitive information, though it does not destabilize the system or cause crashes.

The vulnerability exists in the Linux kernel itself. No specific kernel release dates or versions are listed in the data; all Linux kernel releases that incorporate the EROFS filesystem are potentially affected until an official fixed kernel is deployed.

The CVSS score is unspecified, and EPSS is not available, but the attack requires an attacker to mount a malicious EROFS image or otherwise trigger volume label handling. The likely attack vector is local or user‑initiated, and the exploit does not need elevated privileges beyond the ability to mount the image. Because the impact is limited to leaking references and not system crash or privilege escalation, the overall risk is moderate. The vulnerability is not listed in CISA’s KEV catalog and there are no known widespread exploits.