A flaw in the Linux erofs filesystem handling caused early exits when processing invalid metabox‑enabled images with metadata compression enabled, resulting in folio reference leaks. The exposed references can reveal memory addresses, enabling potential information disclosure, though the issue does not trigger a crash or other severe instability.

All versions of the Linux kernel that use the erofs filesystem before the patch are potentially affected. No specific kernel releases are listed, meaning any distribution kernel embodying the unpatched code may be vulnerable.

The vulnerability’s severity scores are not published, and it is not catalogued in the CISA KEV list. An attacker would need to craft a malicious EROFS image with compressed metadata and deliver it to a system that mounts or inspects that image, so the threat is primarily local or privileged rather than remote. While the impact is limited to memory reference disclosure, the potential for leaking kernel address space could aid further exploitation if combined with other weaknesses.