In the Linux kernel XFS filesystem, the routine that estimates overhead for block reservations incorrectly checks the reservation limit before adding that overhead. Because the check still uses the pre‑overhead value, a request that is actually out of range may be accepted. The corrected value is then passed to the transaction allocator, which uses an unsigned integer for the block reservation. This mismatch allows an adversary to cause the subsystem to reserve more blocks than the system can safely allocate, potentially exhausting kernel resources and resulting in a denial of service.

All Linux kernel releases that include the XFS filesystem before the fix contain this flaw, regardless of the specific kernel version. The upstream kernel code and all distributions that ship unpatched kernel images are affected.

The flaw is local to the kernel and would require an attacker to trigger the reservation code, either via privileged local operations or by exploiting another vulnerability that grants access to the filesystem. The EPSS score of < 1% indicates a low probability of exploitation. The CVSS score of 5.5 reflects a moderate severity. The vulnerability is not listed in the CISA KEV catalog. Because the over‑reservation could exhaust kernel resources, a successful exploitation would lead to denial of service.