The flaw resides in the Linux kernel’s AFFS filesystem implementation, where the buffer_head handling of block sizes larger than PAGE_SIZE is incomplete. When an AFFS filesystem is mounted with a block size that exceeds the page size, the kernel’s folio_set_bh routine triggers a BUG_ON due to an out‑of‑range offset. The result is an immediate kernel panic and loss of service. Because the fault occurs during a core filesystem operation, exploitation can cause a complete system halt. The weakness is a failure to properly validate configuration parameters, causing a crash when an assumption is violated.

All Linux kernel builds that include the AFFS filesystem prior to the commit referenced by 0861182af5983a39bd2a891966436c5679b74a45. The issue affects any system that mounts an AFFS volume, regardless of distribution, as the vulnerability lies in the kernel source itself.

The CVSS score is 5.5, indicating a moderate impact, and the EPSS score is < 1%, showing a low likelihood that this vulnerability will be actively exploited. The existence of a kernel crash still indicates an availability denial of service. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the ability to mount a filesystem or influence kernel configuration, effectively a local privilege scenario. Once triggered, the fault is non‑recoverable without a reboot, ensuring a deterministic denial of service.