The bug in the Linux kernel’s ocfs2 filesystem causes the cleanup routine for preserved extended attribute entries to malfunction. The code fails to shift the 'last' pointer after an entry is removed and also does not clean up the first entry when the count is one, creating dangling references that can lead to a use‑after‑free condition. An attacker with the ability to trigger the cleanup job could potentially manipulate kernel memory, leading to information disclosure, privilege escalation, or system crashes.

The flaw resides in the ocfs2 module of the Linux kernel. No specific kernel version range is listed in the CVE data, so any kernel build compiled with ocfs2 prior to the inclusion of commit c06c303832ec is potentially vulnerable. The issue was reported through multiple kernel commits and is specific to the Linux kernel only.

The CVSS score is 5.5, and the EPSS score is < 1%. This vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local or privileged execution, where an attacker could trigger the buggy cleanup routine. Exploitation requires local or privileged execution to trigger the buggy cleanup routine, making the risk moderate to low for external attackers but potentially higher for compromised or privileged users. Given the lack of public exploitation evidence, the overall likelihood of exploitation is considered low, but careful monitoring is recommended.