A flaw in the BFS (Berkeley File System) implementation of the Linux kernel allows a kernel BUG_ON to trigger during mounting when the block size exceeds the page size. The failure to validate the block size properly causes an out‑of‑bounds check in folio_set_bh, resulting in an immediate kernel panic. The effect is a denial of service that brings the entire system to a halt from the point of mount failure. Exploration of privileged code paths on the affected kernel is not required; the vulnerability manifests during an ordinary mount operation.

All installations of the Linux kernel that include the BFS module are potentially affected. The vulnerability is not limited to a specific kernel release; any kernel version that ships with unpatched BFS code is susceptible. Administrators should verify whether the BFS filesystem is compiled or loaded and identify the exact kernel build in use.

The CVSS score is 5.5, and the EPSS score is less than 1%, indicating a low probability of exploitation. The vulnerability is listed as not in the CISA KEV catalog. Because the trigger occurs during a mount command, the attack requires local or remote execution of a mount operation on the affected host, which typically requires authorized access. Once triggered, the kernel crash provides an instant denial of service without escalating privileges. The absence of a publicly disclosed exploit and the need for a mount operation reduce the likelihood of widespread exploitation. However, the impact of a kernel panic is severe, and any user with the ability to request a mount operation on the target system would be able to trigger it.