The vulnerability resides in the Linux kernel’s XFS filesystem code, where a failure during the creation or commit of a file system metadir leaves behind allocated transaction state, update buffers and inode references. These leaked resources can accumulate with repeated operations, eventually exhausting kernel memory and causing instability or a denial-of-service. The flaw introduces a classic memory‑management weakness that does not expose a direct code-execution path but can degrade system availability through resource exhaustion.

All Linux kernel builds that incorporate the XFS filesystem and that have not yet integrated the patch for xfs_dqinode_metadir_create() are affected. The flaw is tied to XFS and requires the filesystem to be enabled or used; systems that mount XFS in any mode, particularly with the uquota option, are at risk if they run a kernel version that retains the vulnerable code path.

The likely attack vector is a local mount or filesystem operation that triggers metadir creation or commit, such as mounting an XFS volume with the uquota option. The EPSS score of less than 1% reflects its low exploitation probability, and the CVSS rating of 5.5 indicates moderate likelihood that an attacker who can trigger the failure could exhaust memory. The vulnerability is not listed in the CISA KEV catalog, further suggesting that it is a low‑risk, local‑only exposure without a direct privilege escalation or remote attack surface.