The vulnerability resides in the erofs file‑system code of the Linux kernel. On 32‑bit platforms the logical cluster number (lcn) is stored as an unsigned 32‑bit value. When the kernel computes a block address by shifting lcn left by the cluster bit count, the value is truncated at 4 GiB, resulting in incorrect block locations. This truncation can cause file system corruption, data loss, and potentially kernel panics, representing a classic integer overflow flaw (CWE‑190).

All Linux kernel installations that compiled with the erofs file‑system on 32‑bit architectures are potentially affected. The patch was merged before the CVE was disclosed, but any kernel version released before that merge remains vulnerable. No specific release is mentioned, so the impact spans the breadth of 32‑bit kernels that include erofs.

The CVSS score of 5.5 indicates moderate severity, and the very low EPSS score (< 1 %) suggests a low likelihood of exploitation in the wild. The vulnerability is not present in the CISA KEV list. The attack surface is local; an attacker with write privileges to an erofs volume could trigger the truncated address calculation, leading to data corruption. Based on the description, it is inferred that the only exploit path requires local write‑access to an erofs volume, which can trigger the malformed addressing and corrupt data. Since the patch exists, the risk is mitigated once the updated kernel is deployed.