The vulnerability resides in the Linux kernel's F2FS filesystem driver. When the compress_cache mount option is disabled, a synthetic inode number (max_nid) falls outside the valid inode range. A corrupted directory entry that references this out‑of‑range inode should be rejected during the range check, but due to an unconditional meta‑inode treatment, the check is bypassed. As a result, an attacker can cause f2fs_iget() to instantiate a fake internal inode, which may enable unauthorized access to filesystem data or lead to memory corruption.

All Linux kernel versions that ship an F2FS driver and do not yet include the patch that validates the compressed cache inode only when the compress_cache option is enabled. The issue affects any system running such a kernel with F2FS support, regardless of the specific kernel version, until a patched release is applied.

The CVSS score of 7.8 indicates a high severity vulnerability. The EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack likely requires local file system access to supply the corrupted directory entry; hence a local attacker could exploit it. The fix adds a guard that only performs the special inode handling when the compress_cache feature is enabled, restoring the normal inode range checks for all other cases.