The vulnerability arises when the f2fs filesystem trusts an unchecked orphan inode entry count during recovery, allowing the kernel to read beyond the intended buffer—a CWE‑125 out‑of‑bounds read—and trigger an f2fs_bug_on() call. This results in a kernel panic, halting the operating system and requiring a reboot. The impact is a local denial‑of‑service with no data disclosure or code execution potential.

All installations of the Linux kernel that implement the f2fs filesystem without the recent patch are affected. The exact kernel version range is not specified, so every unpatched build that performs orphan recovery is potentially vulnerable.

The CVSS score of 8.4 indicates a high‑impact denial‑of‑service flaw, while the EPSS score of less than 1% reflects a low probability of real‑world exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local, requiring an attacker to provide a crafted f2fs image that the unpatched kernel will mount; if the attacker can influence the mounting of such media (e.g., removable drive or network share), the kernel will panic at mount time.