The flaw lies in the device‑mapper thin pool code of the Linux kernel. When a metadata snapshot is taken or released, the code updates the superblock’s held_root in memory. If the subsequent commit fails, the stale held_root value is flushed to disk through the abort path, leaving the superblock in an inconsistent state and corrupting reference counts in the metadata tree. The result is unreliable block tracking, potential data loss, or inability to correctly free space. This issue covers the weakness known as mis‑handling of data‑structures during error paths (CWE‑367).

All Linux kernels that implement the device‑mapper thin pool are vulnerable until the fix is applied. The advisory lists the product as Linux:Linux and the CPE covers all kernel releases, and no specific version range is supplied, so any kernel built before the patch is at risk.

The CVSS score of 7.8 indicates a high severity, but the EPSS score of <1% shows that exploitation is uncommon at present. The vulnerability does not provide an obvious remote attack vector; its exploitation requires privileged kernel code or a privilege escalation that permits manipulation of thin pool transactions. Consequently, while the impact on data integrity is severe, the likelihood of an external attacker successfully triggering the condition is low under normal circumstances, although an internal attacker or a compromised local process could render the storage unreliable.