The vulnerability resides in the Linux kernel’s f2fs implementation, specifically the __destroy_extent_node() function. When the inode flag FI_NO_EXTENT is set, the function fails to clear the cached largest extent length and does not update the inode’s folio state. Because modifications to the extent tree are then prohibited, the stale cached data may write incorrect values to the inode. A tester found that this leads to the error in xfstests: sanity_check_extent_cache reporting an incorrect extent, which indicates that the filesystem can become inconsistent and may require fsck to correct. This flaw can therefore enable integrity violations or potentially lead to silent data corruption within the f2fs filesystem.

Vendor Linux; product Linux kernel; all kernel versions that ship the f2fs driver before the fix via the referenced patch. The CVE references a commit that reverts an earlier change and removes an unnecessary check, but the exact affected release range is not enumerated. Therefore any system running an unpatched Linux kernel that includes the f2fs filesystem and has not yet incorporated the patch is susceptible.

With a CVSS base score of 7.8 the flaw is considered high severity. The EPSS rating is below 1%, and the vulnerability is not listed in CISA's KEV database; thus it is unlikely to be actively exploited at this time. The likely attack vector is local or privileged kernel access – based on the description, it is inferred that an attacker must have root or a compromised kernel module to trigger the incorrect flag handling or create conditions that expose stale extent data. Even without remote exploitable effects, silent corruption can damage data integrity and could trigger a denial-of-service or lower availability if the file system becomes unusable and requires fsck.