When the hpfs_map_dnode_bitmap function fails, the kernel attempts to use an uninitialized quad buffer head in hpfs_brelse4. This results in a kernel crash that brings the entire system down. The vulnerability does not give an attacker code execution or data disclosure; it simply causes a denial of service in the affected system.

All Linux kernels that include the HPFS filesystem driver and have not yet applied the fix are affected. The CPE entry indicates every Linux kernel release prior to the patch. Systems that mount or access HPFS volume images (e.g., via the hpfs module) are at risk.

The CVSS score of 7.8 classifies the flaw as high severity. EPSS shows a value less than 1%, implying a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known exploitation activity. The likely attack vector requires a local user or privileged process that can trigger the hpfs_map_dnode_bitmap failure, such as manipulating an HPFS file system or sending crafted data to the driver. This leads only to a system crash and does not compromise confidentiality or integrity.