The flaw lies in the f2fs file system within the Linux kernel, where a routine that converts inline dentry entries copies the names before validating that each recorded length fits within the available filename slots. This omission results in a bounded read that can expose kernel memory or trigger a system crash.

Any Linux kernel build that supports f2fs and has not yet incorporated the inline dentry name‑length validation commit remains at risk. No specific kernel version numbers are supplied in the advisory, so standard kernel builds before the applicable commit should be treated as vulnerable until the patch is applied.

The CVSS score of 7.1 signals moderate severity, while the EPSS score of less than 1% indicates a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. An attacker who can create or corrupt an f2fs image could trigger the unchecked copy during the conversion process, potentially retrieving kernel data or causing a denial‑of‑service.