The vulnerability arises from an out‑of‑bounds read in the4_read_inline_dir() function. A directory listing call (getdents64) can read a directory entry header past the end of its inline buffer. This mismatch between the buffer size and the length check allows a kernel memory read, potentially leaking sensitive data. The weakness is a classic improper bounds check leading to an out‑of‑bounds read.

All installations of the Linux not incorporated the patch referenced in the provided commit URLs are potentially vulnerable. The exact kernel versions are not listed, so the vulnerability may affect any pre‑fix release that relies on the ext4 inline directory code path.

The EPSS score indicates an exploitation probability of less than 1 %, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is not provided, so the risk assessment relies on the severity of the defect. A local user with file system access can trigger the read by performing a directory listing on an ext4 filesystem that contains inline directories. Although no public exploits or KEV status are reported, the ability to read arbitrary kernel memory is a severe privilege escalation risk.