When the flexible_inline_xattr feature is enabled, the f2fs filesystem loader reads the on‑disk i_inline_xattr_size value without proper validation unless the inode has the FI_INLINE_XATTR flag. An attacker can craft a filesystem image that sets this value to a large number. The resulting calculations produce negative sizes for inline directory metadata, causing the directory walk logic to compare an unsigned long bit position against a negative maximum. This underflow makes the comparison succeed and triggers an out-of-bounds read of kernel memory in f2fs_fill_dentries(), exposing data beyond the intended inline area and corrupting ADDRS_PER_INODE for regular files. The primary impact is an out‑of‑bounds read that can leak kernel memory or corrupt inode metadata, potentially leading to information disclosure or further compromise.

Any Linux kernel binary that includes the f2fs filesystem and has the flexible_inline_xattr feature enabled is vulnerable. The CNA‐listed vendor/product is Linux:Linux, and because no specific kernel version numbers are supplied, the vulnerability applies to every kernel distribution that ships with f2fs supporting the flexible inline attribute feature. Operating systems that install or compile f2fs with that feature enabled are therefore at risk.

The CVSS score of 8.4 signals a high severity vulnerability. EPSS less than 1% suggests a low current exploit probability, and the flaw is not listed in CISA's KEV catalog. The attack requires the ability to provide a crafted f2fs image to a system that mounts that filesystem, meaning a local attacker with filesystem mounting privileges, or a privileged process that can initialize an f2fs volume. The exploitation path is local and depends on a mount of a malicious image; denial of service or information disclosure can result from the out‑of‑bounds read of kernel memory.