The XFS filesystem routine that estimates block reservation overhead calculates the required blocks, then adds bmbt and rmapbt overhead before performing a limit check. However, the check mistakenly uses the pre‑overhead value. As a result, the transaction allocator receives a reservation size that may exceed the configured maximum. An adversary who can trigger block reservation—by using privileged local actions or leveraging another vulnerability—could force the kernel to reserve more blocks than the system can safely allocate, potentially exhausting kernel memory and causing a denial of service. The patch corrects the limit check to use the fully calculated reservation size, ensuring the block reservation stays within allowed limits.

All Linux kernel versions that ship the XFS filesystem before the patch are affected. This includes every distribution that distributes unpatched kernels with the default XFS implementation.

The flaw is local to the kernel and requires an attacker to invoke the block reservation code, normally through privileged local operations or by combining with another flaw that provides such access. The EPSS score of < 1% indicates a low probability of exploitation. The CVSS score of 5.5 denotes moderate severity. The vulnerability is not listed in the CISA KEV catalog. If successfully exploited, the over‑reservation could deplete kernel resources and result in a denial of service.