This vulnerability stems from the Linux kernel’s XFS filesystem failing to release an inode lock when an error occurs during a quota operation. The function xfs_dq_get_next_id() acquires the quota inode ILOCK before attempting to read extents, but if that read fails it returns immediately without unlocking, leaving the inode locked. This lock leak can cause subsequent quota operations to block indefinitely, leading to a denial of service for processes that rely on quota management. The weakness is a classic resource acquisition without release scenario, identified as CWE-689.

Any system running a Linux kernel that supports the XFS filesystem and uses the quota facilities is potentially affected. The CNA vendor list includes Linux:Linux twice, indicating the entire kernel is impacted, but specific kernel versions are not enumerated in the data provided. Consequently, any deployment using the vulnerable code path may be at risk until the patch is applied.

The CVSS score is not provided, and the EPSS score is unavailable, but the denial of service nature of the flaw means that exploitation is feasible in scenarios where an attacker can induce quota queries that trigger the error path. The breach could be local or remote depending on filesystem exposure, though the data suggests a local or privileged‑user attack is most likely. The vulnerability is not listed in the CISA KEV catalog, indicating no current exploitation evidence. Nonetheless, the potential for service disruption warrants prompt attention.