The vulnerability is a use‑after‑free occurring in the f2fs garbage‑collection path. During the F2FS_IOC_GARBAGE_COLLECT_RANGE ioctl, the garbage‐collection code may drop a reference to an atomic inode without ensuring the inode still exists before accessing its mapping. When the atomic inode has been freed, the kernel dereferences a stale pointer, triggering a memory corruption that can crash the system or lead to escalation of privileges if additional weaknesses are present.

All Linux kernel releases that include f2fs filesystem support and implement the atomic inode path described in the commit history are affected. This applies to any distribution that ships an unpatched kernel with f2fs enabled, regardless of the specific kernel version. Users must verify whether their kernel has incorporated the commit that adds a reference check on f2fs_inode_info.atomic_inode before accessing its mapping during garbage collection.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% suggests a low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no widespread exploitation has been confirmed. The likely attack vector is local or privileged; an attacker must run code that can invoke the garbage‑collection ioctl on a f2fs file and influence the lifecycle of the atomic inode. Successful exploitation could cause kernel memory corruption, lead to crashes, or provide a foothold to privilege escalation if combined with other kernel weaknesses.