The Linux kernel contains a flaw where the function responsible for replaying XFS log items writes data into a buffer without proper bounds checking. An attacker can construct a filesystem image that advertises a small buffer length while including bitmap entries that reference offsets beyond that length. During mount-time recovery, the memcpy call will then write past the allocated buffer, corrupting adjacent kernel heap memory. If the corruption is exploited, it can lead to arbitrary code execution with system privileges or a denial‑of‑service by crashing the kernel.

Any Linux kernel implementation that includes the XFS filesystem with a version prior to this fix. The Advisory does not list a specific affected version, so all builds using XFS are potentially vulnerable until the patch is applied.

The vulnerability is considered severe because it corrupts kernel memory; however it is not listed in the CISA KEV catalog and no EPSS score is available. Exploitation requires an attacker to craft and mount a malicious filesystem image, meaning the threat is limited to environments that allow untrusted images to be mounted. Once mounted, the flaw can be triggered automatically during log recovery, potentially granting kernel‑level privilege escalation or causing a system crash.