The Linux kernel buffer allocator for the XFS filesystem contains a bug that leaves a newly allocated buffer locked when an I/O error occurs while writing the dirty buffer list. The function xfs_btree_bload_drop_buf fails to release the buffer (new_bp), resulting in a resource leak that can drain the XFS buffer pool or create a deadlock, ultimately causing a denial‑of‑service condition for applications that rely on the affected filesystem.

All distributions that ship the standard Linux kernel with XFS support are impacted. Every architecture (x86, ARM, etc.) that builds the kernel without the patch is vulnerable; the specific kernel release is not enumerated, but any build predating the commit that resolves the issue is susceptible.

The CVSS score of 5.5 indicates a moderate severity, while the EPSS score of less than 1% signals a low probability of exploitation. It is not listed in CISA’s KEV catalog, further suggesting limited operational prevalence. Based on the description, the likely attack vector requires local execution or elevated privileges to trigger an I/O error on the XFS buffer list, making widespread remote exploitation unlikely. The impact remains limited to resource exhaustion or service interruption on the local host.