The flaw resides in the OCFS2 filesystem module of the Linux kernel. During the validation of refcount blocks, the fields rl_used and rl_count are not bounded against the on‑disk record capacity, allowing a crafted block with rl_used set to 0xffff to cause the code to walk far beyond the 4 KiB boundary. The subsequent memmove operation can copy up to approximately one megabyte from an invalid location, producing an out‑of‑bounds read and write that corrupt the kernel address space. If triggered, this corruption can lead to privilege escalation or arbitrary code execution in the kernel context. The vulnerability does not rely on network exposure; it requires local access with sufficient privileges.

Affects all Linux kernel implementations that include the OCFS2 filesystem module. The vulnerability exists in the refcount block validation logic used by OCFS2 and thus is present in any kernel version that supports OCFS2. No specific version constraints were enumerated by the CNA; the issue occurs in the default implementation shipped with Linux kernels following the release notes. Consequently, any system running a kernel with OCFS2 mounted can be affected.

CVSS score of 5.7 indicates moderate severity, while the EPSS score (< at present. The vulnerability is not listed in the CISA KEV catalog. An attacker must have local access and elevated privileges such as CAP_SYS_ADMIN to mount a crafted OCFS2 image or perform raw writes to the underlying block device. The exploit, if successful, would trigger an out‑of‑bounds read and subsequent write during refcount handling, potentially leading to kernel corruption, a crash, or privilege escalation. Given the low EPSS and the local‑only requirement, the overall risk to environments with robust privilege controls remains moderate.