The vulnerability arises from an off‑by‑one error in XFS’s rtrefcount B‑tree root‑level validation. A specially crafted rtrefcount image whose root level equals the maximum allowed value bypasses on‑disk checks, causing XFS to initialize a cursor with one level beyond the allocated array. The resulting out‑of‑bounds write triggers a kernel slab‑out‑of‑bounds error and can crash the kernel, leading to denial of service. The likely attack vector involves providing such a malicious rtrefcount image, for example during filesystem creation or by replaying metadata, but this is inferred from the description.

All Linux kernel versions that contain the unpatched rtrefcount B‑tree code are affected, regardless of distribution. The fix is applied in recent kernel releases; any kernel older than the commit referenced in the advisory is vulnerable.

The flaw carries a CVSS score of 7.8, indicating high impact. EPSS data is not available, so the exploitation likelihood cannot be quantified precisely. The vulnerability requires a crafted XFS filesystem image, implying that local file system access or root privileges makes exploitation more likely. The vulnerability is not listed in the CISA KEV catalog, but a kernel panic resulting from the out‑of‑bounds write leads to denial of service, making it a serious security concern.