During the handling of extended attributes on an HFS+ filesystem, the kernel dereferences a null pointer when setxattr is called and the attributes file has not yet been loaded during mount, causing a KASAN error followed by a kernel panic that results in a system crash.

All Linux kernel implementations that ship stock kernels prior to the commit removing the duplicate dirty‑marking action are susceptible. This includes every distribution that has the kernel at or before the vulnerable release, even if the HFS+ filesystem is not enabled by default.

The EPSS score of < 1% indicates a very low probability of exploitation. The CVSS score of 5.5 indicates moderate severity, while the presence of a kernel panic demonstrates a severe local denial‑of‑service impact. Exploitation would require a local attacker to invoke setxattr on an HFS+ volume that has not loaded its attributes file during mounting. The weakness is not currently listed in the CISA KEV catalog, so no widespread exploitation has been observed.