In the Linux kernel, omfs normally relies on buffer_heads to manage storage blocks. The bug occurs when omfs attempts to set a block size larger than the kernel's page size; the buffer handling code does not correctly validate this scenario. As a result, the kernel hits an internal BUG_ON assertion during the first __bread_gfp call, causing a panic. This crash disables the affected system and results in a denial‑of‑service condition for any process that attempts to mount an omfs file system with an oversized block size.

All Linux kernel builds that have not yet incorporated the commit fixing this bug are vulnerable. No specific kernel releases are listed in the data, but the referenced Git commits indicate the issue was present before the patches were merged. Consequently, any distribution using an unpatched Linux kernel is at risk until the fix is applied.

The vulnerability is triggered when an omfs file system is mounted with a block size exceeding PAGE_SIZE, which typically requires elevated privileges or the ability to control mount options. The likely attack vector is mounting the file system with an oversized block size, and the description indicates this is inferred from the bug trigger condition. While the EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, the potential for a kernel crash makes it a high‑impact issue. The CVSS score of 5.5 indicates a moderate severity. Attackers with sufficient local or privileged access could exploit this by forcing a mount that triggers the BUG_ON, resulting in a system reboot or loss of service.