This vulnerability originates from a logic flaw in the Linux kernel XFS filesystem code that mis‑manages freemap entries when they become zero‑sized. The bug can allow an expansion of the extended attribute array to produce a zero‑size freemap entry with a non‑zero base. Subsequent attribute operations may create another entry with the same base but a non‑zero size, giving the allocation code the illusion of free space where none exists. When a new extended attribute is added, space can be written on top of the existing entries array, corrupting data stored in the file system and causing loss of integrity for affected files.

All Linux kernel releases that include XFS support are affected when the kernel has not been patched to include the commit that deletes zero‑size freemap entries. This includes most mainstream distributions that ship the upstream kernel version in which the defect existed.

The defect is a local integrity flaw; an attacker must have write access to a volume formatted with XFS on a system running the vulnerable kernel. There is no publicly available remote exploitation vector. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting a moderate likelihood of exploitation in the wild. Nevertheless, because the defect can silently overwrite data, it should be treated as a high risk to data integrity. Incrementally applying a kernel that includes the fix mitigates the threat.