The erofs filesystem in the Linux kernel contains a bug where a metabuffer allocated during inode extended attribute initialization is not released on all error paths, causing a folio reference leak. This resource‑management flaw leads to kernel‑level memory usage that can grow over time, potentially exhausting available memory and degrading system stability. The vulnerability is classified as a CWE‑772 resource leak, and the assigned CVSS score of 5.5 reflects its moderate severity. While the description does not specify an immediate denial‑of‑service outcome, the risk of unchecked memory consumption can result in system slowdown or kernel panic if left unmitigated.

Linux kernel versions that include the erofs filesystem prior to commit bb88e8da0025 are affected. Any system running a prepatched kernel that mounts erofs volumes is potentially at risk, regardless of distribution, kernel configuration, or user privileges. The impact cannot be limited to a specific vendor because the flaw resides universally in the Linux kernel's erofs implementation.

Based on the description, it is inferred that exploitation requires local access with permission to perform extended attribute operations on an erofs filesystem. The EPSS score of less than 1% indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is a resource‑leak in kernel memory management, it does not enable code execution or data disclosure. However, repeated triggering of the error paths can lead to unchecked kernel memory growth, potentially exhausting system memory or causing instability, which could degrade performance or, in worst cases, trigger a kernel panic.