The vulnerability is a race condition in the erofs file system. When unaligned compressed extents are processed concurrently, two threads may add the same folio to the file map before the private flag is cleared, which can corrupt filesystem structures and data. The flaw is identified as concurrency errors (CWE-362) and concurrent updates of shared resources (CWE-367).

All Linux kernel versions that support erofs and allow unaligned compression, such as the -E48bit zstd option. The issue exists in any kernel build prior to the commit that clears folio->private before exposing the folio to the managed cache. No specific vendor or product ranges beyond the generic Linux kernel are mentioned.

The CVSS score of 7.8 indicates high severity, yet the EPSS score of less than 1 % suggests a low likelihood of real‑world exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker who can write to an erofs partition that has unaligned compression enabled could trigger concurrent operations to induce the race, potentially leading to data corruption or denial of service. Overall risk is moderate to high for affected systems, with exploitation unlikely without targeted configurations.