The defect lies in the GFS2 filesystem’s quota initialization routine. An iterator that steps through quota records was incorrectly incremented inside the loop’s body, causing the loop to use stale or incorrect data. No evidence of exploitation or impact is provided in the payload.

All Linux kernel builds that include the GFS2 filesystem may be affected. The CVE does not enumerate kernel versions, so any kernel containing the unpatched logic is potentially vulnerable. Administrators should verify whether their kernel provides GFS2 support and whether the patched commit (identified by the commit URLs) has been applied.

The CVSS score of 7.1 indicates moderate to high severity, but no evidence of exploitation or impact is documented. No EPSS indicator is available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation would presumably require local or privileged access, but such exploitation has not been reported. Until a patch is deployed, the risk remains uncertain for systems using GFS2.