An integer overflow in the exfat module’s up‑case table creation causes the kernel to enter an infinite loop whenever the table size is zero. This condition can arise from corrupted media or misbehaving devices. The loop consumes CPU resources and blocks the kernel context that accessed the filesystem, freezing any processes interacting with that mount until the kernel is rebooted or the volume is remounted. The failure mode is a complete denial of service on the affected system.

The flaw resides in the Linux kernel’s exfat filesystem driver. Any kernel that ships with the default exfat module is potentially impacted, regardless of version, until the patch that prevents zero‑size table handling is applied.

The CVSS score is 5.5, the EPSS score is < 1%, and the vulnerability is not listed in CISA KEV. The attack vector is likely local or via removable media, requiring access to a device containing a damaged exfat volume or the ability to cause corruption on a mounted volume. Exploitation can result in a full system denial of service. The low EPSS score suggests that exploitation is unlikely, but the availability threat remains.