The Linux kernel's XFS filesystem module contains an issue in the path creation logic. When a new directory path is created and appending the directory name fails, the function xchk_dirtree_create_path fails to release the seen inode bitmap, resulting in a memory leak. Over time, repeated failures can consume kernel memory, leading to a degradation of system performance and potential out‑of‑memory conditions. The vulnerability does not provide direct remote code execution but can affect system stability for any user that can trigger the directory creation failure.

This flaw affects the Linux operating system with XFS support. Any kernel build that uses the XFS filesystem may be impacted; version information is not supplied, so all recent releases prior to the fix should be considered potentially vulnerable.

The flaw is local in nature and would generally require the ability to create directories on an XFS volume where the name append operation fails. The CVSS score of 5.5 indicates moderate severity. The EPSS score, measured at less than 1%, suggests a very low likelihood of exploitation, and the vulnerability is not listed in CISA's KEV catalog, indicating limited evidence of exploitation. Nevertheless, repeated failures could exhaust kernel memory, creating a denial‑of‑service risk and potentially jeopardizing availability for privileged users or services that rely on XFS.