The vulnerability originates from the XFS file system code that cycles the ILOCK to obtain a transaction in the helpers xfs_reflink_fill_cow_hole and xfs_reflink_fill_delalloc. The cycle invalidates the data fork mapping before the helpers refresh it, while only the COW fork mapping is refreshed. Consequently, a stale mapping is used during a direct I/O write, which may cause the filesystem to refer to wrong physical blocks and corrupt data. This is a race condition (CWE-362) affecting data integrity.

The flaw resides in the Linux kernel’s XFS implementation, impacting all distributions that ship the affected kernel. RedHat Enterprise Linux 8, 9, 10 (including all EUS, E4S, TU, AUS variants) are listed as affected by the CPEs provided. Any system using these kernels and XFS file systems is potentially vulnerable.

The CVSS score of 7.8 indicates a high severity flaw. The EPSS score of < 1 % indicates a very low probability of exploitation in the wild at the time of this analysis. It is not presently listed in CISA’s KEV catalog. The most likely attack vector is inferred to be local or privileged because the code path requires direct I/O operations that typically run with elevated privileges. If an attacker can trigger the faulty code, the risk is data corruption and possible loss of file integrity. As the flaw is not yet a known exploit used in the field, the immediate threat remains moderate to high until patches are in place.