The Linux kernel Minix file‑system driver contains an integer overflow in the formula that calculates the required number of bitmap blocks while validating a superblock. When a malicious Minix v3 image sets the on‑disk inode or zone count close to the maximum unsigned integer value, the division rounding operation wraps around to zero, causing the driver to incorrectly interpret a zero bitmap‑block count as valid and dereference the first bitmap buffer pointer, which results in a kernel panic and loss of system stability.

All Linux kernel releases that have not incorporated the overflow fix and that include the Minix v3 file‑system driver are vulnerable; any build capable of mounting a Minix v3 image is at risk, although no specific kernel versions are enumerated in the advisory.

The EPSS score of <1% indicates a very low probability of exploitation, yet the CVSS score of 7.8 reflects high impact. Exploitation requires an attacker to provide a crafted Minix v3 image, typically by mounting it via a loopback device, representing a local access scenario that leads to a kernel panic (denial of service). No remote exploitation path or KEV listing exists.