In the Linux kernel, exchanging full‑file ranges on an XFS filesystem can incorrectly clear the reflink inode flag when the XFS_EXCHMAPS_INO1_WRITTEN flag is used. This post‑operation cleanup may remove the flag from an inode that still owns shared written extents, causing subsequent writes to use a non‑copy‑on‑write path and corrupt data that should have been protected by CoW. The weakness involves improper flag handling and is related to the CWE‑281 category.

The vulnerability is present in all Linux kernel versions that use the XFS filesystem and have not yet incorporated the patch that disables flag exchange when XFS_EXCHMAPS_INO1_WRITTEN is requested. Exact affected versions are not listed, so any kernel lacking the referenced commits (56f87ac2b954, 8ae30b9a8c207, a23eca88448, fac32b9950a2) may be vulnerable.

Based on the description, it is inferred that the attack vector requires the ability to perform full‑file range exchanges on an XFS filesystem, which typically demands local filesystem access and the necessary permissions to manipulate the target files. The EPSS score of <1% indicates a low probability of exploitation, while the CVSS score of 7.0 classifies the issue as high severity. The vulnerability is not listed in the CISA KEV catalog. The primary risk is data corruption rather than remote code execution; an attacker would need to execute legitimate file swap operations on the affected system to trigger the bug, making the likelihood of exploitation low but not negligible in environments where such operations are common.