The vulnerability stems from a race condition in the f2fs filesystem’s page‑cache management, specifically within the move_data_block() routine. When a tail‑end folio is evicted by the garbage‑collection path and removed from i_pages, the page‑cache references for its subpages are dropped. If a split operation then proceeds on that folio while those references are gone, the folio can be freed back to the allocator while its LRU links remain in the kernel’s LRU list. If, concurrently, folio_isolate_lru() clears the PG_lru flag before the final folio_put() runs, the page ends up freed but still linked in the LRU, leading to list corruption that triggers a kernel panic. This aligns with CWE‑367 and results in a system‑wide denial of service.

Any system running a Linux kernel that includes the f2fs code path before the revert of commit 9609dd7 is potentially affected. Administrators should verify whether their installed kernel version contains the revert commit or remains in the vulnerable state. Kernels that have applied the revert are considered safe; all others should be treated as susceptible. The CMN product list cites Linux:Linux, indicating that broadly any Linux kernel distribution is at risk if the kernel tree includes the vulnerable code.

The CVSS score of 7.8 represents moderate to high severity, while the EPSS score of less than 1% and the lack of a KEV listing imply a low current exploitation probability. Exploitation requires the f2fs partition to be nearly full, meaning that a local or elevated‑privilege attacker can trigger the crash by filling the filesystem. The flaw provides a denial‑of‑service without directly compromising confidentiality or integrity. No publicly available exploit code is documented in the provided references, and the race condition’s timing requirements make automated exploitation difficult.