The vulnerability occurs in the Linux kernel’s XFS filesystem implementation. Two internal functions that calculate the maximum number of in‑memory B‑tree cursor levels omit the inode root from their calculation, allowing a cursor to reference beyond its allocated memory when the B‑tree is sufficiently large. This out‑of‑bounds access can corrupt kernel memory and may lead to crash (denial of service) or, if exploited with sufficient control, code execution. The weakness is an example of improper buffer size calculation (CWE‑119).

All Linux kernel releases that use the XFS filesystem and contain the affected functions before the 108114437915e61e8f88d1cbcc442c3f886a347e patch. The patch is incorporated in newer kernel versions; the exact affected product list is not enumerated here, but any kernel that shipped before the fix is potentially vulnerable.

The CVSS score is 7.8, but the EPSS score is not available and the vulnerability is not listed in CISA KEV, indicating that it has not yet been broadly exploited. Nonetheless, an attacker with local or privileged access could create a large XFS B‑tree to trigger the out‑of‑bounds read/write. The risk is high for systems that rely on XFS and have unpatched kernels. The primary vector is local or privileged, with the potential to transition to broader impact if kernel memory corruption is achieved.