This vulnerability stems from an unchecked left shift of the sb->bblog_shift value during badblocks processing in the Linux kernel. When this 8‑bit field, read from the superblock, is larger than expected, the shift operation overflows the 64‑bit sector calculation, potentially causing badblocks_set to operate on incorrect sector ranges. The overflow can result in kernel crashes or corruption of bad block data, leading to denial of service or data loss. The weakness is an integer overflow (CWE‑190).

All versions of the Linux kernel that lack the added overflow guard in super_1_load() are affected. The issue exists in all mainstream releases before the commits 35d522bd… and 3b097416… that introduced the check. Systems running these kernels on any distribution that does not yet incorporate the patch are susceptible; distributions that have applied the latest kernel update are not impacted.

The CVSS score of 4.4 indicates a moderate risk. The EPSS score is less than 1%, indicating a very low but nonzero probability of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector is mounting a filesystem with a deliberately corrupted bblog_shift field during filesystem initialization, which requires local access to mount the filesystem. By placing a malicious filesystem on storage that will be mounted, an attacker could induce the overflow during badblocks processing, potentially causing a crash or data corruption.