In the Linux kernel, the XFS filesystem recovery routine entered an infinite loop when it encountered an unused directory entry that claimed to have zero length. The result is continuous CPU consumption during salvage operations, effectively denying service. This flaw is a classic denial‑of‑service weakness caused by improper validation of filesystem metadata, a resource exhaustion flaw in the style of CWE‑835.

All Linux kernel builds that include the XFS filesystem are affected, as the CPE identifier refers to the entire kernel. No specific version range is supplied, so any kernel prior to the implementation of the patch could be vulnerable. Administrators should consult vendor release notes for the kernel version containing the fix.

The CVSS score is 5.5, indicating a moderate impact, and the EPSS score is below 1%. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require triggering XFS recovery with a crafted corrupted directory entry; the likely attack vector is inferred to be a local or crash‑induced scenario. The infinite loop can lead to CPU exhaustion, so if the system must recover from bad metadata, the risk of a denial‑of‑service attack is high. Operators should treat this as a moderate‑impact issue and prioritize updating the kernel.