In the Linux kernel’s XFS filesystem, two internal functions that calculate the maximum number of in‑memory B‑tree cursor levels fail to include the inode root in their size calculation. This oversight can cause a cursor to reference memory beyond its allocated bounds when the underlying B‑tree is sufficiently large, leading to out‑of‑bounds memory reads or writes. The resulting kernel memory corruption can manifest as a crash or, if an attacker controls the data leading to the fault, could be a stepping stone to privilege escalation or arbitrary kernel code execution.

All Linux kernel releases that include the unpatched XFS rtrmap and rtrefcount _maxlevels_ondisk functions are affected. The vulnerability resides in the kernel, so any system running a kernel version that predates the commit that introduces the fix is potentially vulnerable. Systems that use XFS for file storage are at risk, while kernels patched after the commit are safe.

Based on the description, it is inferred that an attacker would need local or privileged access to modify XFS metadata or create an excessively large B-tree to trigger the out-of-bounds access; the attack vector is likely local. The CVSS score of 7.8 indicates a high severity, but the EPSS score of less than 1% and the absence from CISA KEV suggest a low probability of exploitation in the wild. An attacker with local or privileged access could manipulate XFS to create an extremely large B-tree, triggering the out‑of‑bounds memory access. Although the attack surface is limited to systems using XFS and the need for kernel modification, the potential impact on confidentiality, integrity, and availability is significant in an unpatched environment.