f2fs, the Linux file system, implements the listxattr operation without verifying that an‑attribute entry is located within the valid metadata area. If a corrupted entry points outside this area, the operation reads memory beyond its intended bounds, which may return corrupted data or trigger an error condition. The recent commit introduces a validation step that checks the entry’s bounds and returns –EFSCORRUPTED instead of a partial success, preventing the out‑of‑bounds read but not restoring previously returned data.

Any Linux kernel that ships with the f2fs filesystem and does not yet contain the bounds‑checking commit is affected. This condition applies to all builds that include f2fs and that mount or operate on f2fs‑formatted volumes. Systems using other filesystems or patched kernels are not impacted.

The CVSS score of 7.8 indicates a high severity. The EPSS score of <1% suggests that, as of this analysis, the likelihood of exploitation is low. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is an attacker able to create or inject corrupted extended-attribute data on an f2fs volume, such as through a device-based attack or local privilege. The risk manifests as a local denial of service or data corruption when the listxattr operation encounters malformed entries.