The vulnerability is a race condition in the f2fs filesystem checkpoint process where f2fs_need_dentry_mark accesses nat_entry flags without acquiring the sbi->node_write lock. When a write and fsync operation on the same inode occur concurrently, the function may set the DENT_BIT_SHIFT flag after the inode has already been checkpointed. This inconsistency can cause fsck to report a mismatch and may lead to corrupted or lost metadata if the filesystem continues to use the corrupted inode. The weakness is a data race (CWE‑367).

All installations of the Linux kernel that include the unpatched f2fs code are vulnerable. The advisory does not list specific kernel versions, so any distribution using a kernel derived from a tree older than the commit that adds the patch must be examined. A kernel source tree that contains the commits identified by the patch references has the fix and is not affected.

The CVSS score of 7.1 indicates moderate severity, while the EPSS score of less than 1% signals a very low likelihood of exploitation. Based on the description, it is inferred that the attack vector is local, requiring a user to orchestrate a race between a file write and a fsync operation on an f2fs‑mounted filesystem. The flaw does not provide remote code execution or privilege escalation. The primary consequence, if exploited, is filesystem inconsistency that could result in data loss or availability impact. The vulnerability is not listed in the CISA KEV catalog.