During directory entry lookup the exfat driver frees a buffer_head before all references to its data are released, so the following read on the freed buffer can dereference invalid memory. When the TYPE_EXTEND branch executes, the kernel may crash with a page fault or corrupt memory. The description does not state that code is executed, but such memory corruption could potentially be leveraged to run code with kernel privileges if an attacker can control the corrupted data.

All Linux kernels that ship the stock exFAT module and have not applied the patch that moves the brelse() call after the data is accessed are affected. This includes the default kernel packages from major distributions where exfat support is enabled.

With a CVSS score of 9.8, the flaw is classified as Critical. The EPSS score is below 1 %, indicating a very low likelihood of exploitation in the wild at the time of this analysis, and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could trigger the flaw by delivering a maliciously crafted exFAT image through a removable medium or a network share, potentially leading to a kernel panic or memory corruption. The exploitation path would depend on the environment and is not demonstrated in the public data.