A flaw in the f2fs filesystem’s ACL import routine allows an attacker to craft a malformed ACL that causes f2fs_acl_from_disk() to read beyond the end of the allocated ACL entry buffer. The function attempts to access the e_id field without verifying that a full ACL entry structure fits, resulting in an out‑of‑bounds read detected by KASAN. This race can lead to a kernel panic or the disclosure of kernel memory contents, compromising reliability and confidentiality. No remote code execution has been demonstrated, and the vulnerability chiefly facilitates denial‑of‑service or information leakage.

All Linux kernel installations that mount f2fs filesystems and have not applied the patch adding full ACL size validation. The defect exists in the kernel tree regardless of distribution; any vendor shipping an affected kernel version is affected. Impact is confined to systems that enable ACL support on f2fs; disabling ACLs removes the trigger path.

The CVSS base score of 7.8 signals a high severity, but the EPSS score is reported as <1% and the vulnerability is not in the CISA KEV catalog, indicating a low probability of exploitation. The attack vector is local: an adversary must be able to write a tailored ACL entry to a file on a f2fs filesystem, a privilege usually requiring root or equivalent access. While a successful exploit can crash the system or leak memory, the lack of a public remote trigger and the requirement for local privileged access reduce the practical risk on most deployments.