The vulnerability occurs in the OCFS2 filesystem’s ioctl handling when the OCFS2_IOC_INFO command is invoked with the non‑coherent flag. The code uses the on‑disk bg_bits field directly as a scan limit without validating that it fits the bitmap size, causing an out‑of‑bounds bitmap walk. Over‑reading leads to a use‑after‑free that KASAN reports, potentially allowing a local attacker to trigger a kernel panic or execute arbitrary code with kernel privileges. The defect stems from improper input validation and missing boundary checks.

Linux kernel with OCFS2 support, before the patch that validates bg_bits. No specific vendor version list is available; the fix was applied to the upstream kernel.

The CVSS and EPSS scores are not provided and the flaw is not listed in CISA’s KEV catalog. Exploitation requires crafting a malformed OCFS2 filesystem and invoking the non‑coherent ioctl, a moderate complexity action. No public exploit is known, but a vulnerable system could suffer denial of service or privilege escalation if an attacker can manipulate the filesystem.