During atomic writes on the f2fs filesystem, the write‑begin path mistakenly uses the original inode for decryption and inline crypto when handling copy‑on‑write data. This mismatch causes the fscrypt routine to dereference a NULL crypt‑info pointer, resulting in a kernel panic. The flaw is a classic null‑pointer dereference (CWE‑476). The crash effectively denies service by rendering the system unresponsive.

The vulnerability affects every Linux kernel build that enables f2fs before the patch is applied. No specific kernel versions are listed, but the defect exists across all unpatched releases that contain the f2fs code handling atomic writes and encryption. It is triggered whenever a writable f2fs partition is present and write operations occur on files encrypted with or without the f2fs COW mechanism.

The EPSS score is less than 1 %, indicating a very low probability of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog. However, the impact of a successful exploit is high— a kernel panic leads to a full denial of service. Based on the description, it is inferred that the likely attack vector is local; any process with write access to a file on an affected f2fs partition can trigger the crash. If the partition is exposed through network services, remote triggering could be possible. In the absence of a CVSS score, the crash nature itself suggests a critical severity.