The ocfs2 filesystem in the Linux kernel includes a debugfs iterator that snaps lock resource structures then formats them for display. When the iterator copies a lock resource snapshot, a subsequent lock teardown frees the original structure while a dangling pointer still references it. The debugfs read routine then accesses this freed memory, causing a KASAN slab‑use‑after‑free and potentially crashing the kernel or exposing the contents of the freed buffer. This flaw transforms an internal consistency bug into a kernel object reuse vulnerability that can lead to a denial service or information disclosure if triggered.

Any Linux kernel that ships the ocfs2 module before the patch referred to in the provided commit URLs is affected. This includes all distributions that have not yet applied the commit that rebases the copied LVB pointers in the locking_state debugfs iterator. Systems using ocfs2 on those kernels are potentially impacted.

The CVSS score of 5.5 indicates medium severity, while the EPSS score of <1% signals a very low probability of exploitation. The flaw is accessible only through the debugfs interface, so the attack vector is local; it requires a user with sufficient privileges to read from /sys/kernel/debug or to cause a lock state read while another process releases an ocfs2 lock. Based on the description, it is inferred that an attacker must orchestrate the lock‑teardown and debugfs read timing to trigger the use‑after‑free, which increases complexity. There is no public exploit and the flaw is not listed in CISA KEV, reducing the immediate threat but still presenting a risk of kernel crashes or data leakage if the conditions are met.