The CVE targets the XFS filesystem’s quota iterator. When the 32‑bit identifier counter reaches XFS_DQ_ID_MAX, the addition operation overflows and wraps to zero, causing the iteration to restart from the beginning of the quota list. Based on the description, it is inferred that an attacker could exploit the wrap‑around to skip quota checks for files or users associated with the maximum identifier, potentially allowing them to consume disk space beyond their allocated quota.

All Linux kernel deployments that use the XFS filesystem and include the dqiterate routine are affected. The flaw exists in any kernel where the routine performs the counter increment without converting the value to 64 bits; no specific kernel versions are listed, so any kernel lacking the patch is vulnerable.

The CVSS score of 5.5 indicates a moderate severity, and the EPSS score of less than 1% suggests low exploitation probability. The vulnerability is not listed in CISA's KEV catalog. Based on the description, the likely attack vector involves local access to a filesystem containing a dquot with the maximum ID and the ability to trigger the quota iterator; thus the exploitation requires privileged local access and is a moderate effort to achieve.