The vulnerability resides in the OCFS2 filesystem module of the Linux kernel. It is an out‑of‑bounds write in the function ocfs2_remove_refcount_extent that is triggered when the last leaf block of a refcount tree is removed. The incorrect bulk memory set writes beyond the allocated size, which the fortify checker detects and a fortify panic causes the kernel to crash. This results in a denial‑of‑service condition, forcing a system reboot and loss of availability.

Any installation of the Linux kernel that includes the OCFS2 module and has not applied the recent patch is susceptible. The advisory does not list specific kernel release numbers, so affected kernels are those that were in use at the time of the commit that fixed the out‑of‑bounds write.

The CVSS score of 8.8 denotes a high severity vulnerability, but the EPSS score of less than 1% indicates a low likelihood of exploitation. The issue is not present in the CISA KEV catalog and no public exploits have been reported. Exploitation requires local access to a system running OCFS2 to unlink a refcounted file, so the threat is confined to environments with local compromise. The risk is therefore moderate: a high‑impact crash that is unlikely to be widely targeted due to the local access requirement.