The bug in the Linux XFS filesystem incorrectly clears the reflink (copy‑on‑write) flag on an inode during a full‑file range exchange. The logic assumes that all mappings are swapped, but when the XFS_EXCHMAPS_INO1_WRITTEN flag is set, hole and unwritten mappings may be skipped. The flag can then be cleared while the inode still owns shared written extents, causing subsequent writes to bypass copy‑on‑write protection. This leads to corrupted data in reflink‑related files, violating confidentiality and integrity constraints of the affected data.

The vulnerability resides in the Linux kernel XFS subsystem and is therefore present in any Linux kernel version that contains the legacy code path. No specific version information was provided, so all kernel releases that have not yet applied the commit fixing the issue are potentially affected.

No EPSS information is available. The vulnerability is not listed in the CISA KEV catalog. The flaw requires manipulating the XFS exchange‑range operation, which is a privileged kernel action typically restricted to users with sufficient filesystem or root privileges. Based on the description, the attack vector is inferred to be a local administrative or root user. While the risk of exploitation is moderate given the need for elevated privileges, the potential for non‑repudiable data corruption is significant.