The vulnerability arises when the variable ‘error’ in xfs_defer_finish_one() is declared without an initializer and is only set inside a loop over dfp->dfp_work. If that list is empty the loop never runs, causing the function to return an indeterminate value. That non‑zero value is later treated as a fatal error by xfs_reap_ag_blocks(), triggering a SHUTDOWN_CORRUPT_INCORE condition during an XFS online repair, which can corrupt the inode cache and lead to a system shutdown.

All Linux kernels that include XFS support and are built with CONFIG_XFS_ONLINE_REPAIR enabled, including any distribution shipping the upstream kernel or a downstream derivative that has not applied the patch.

The flaw does not provide a remote code execution path; exploitation requires initiating an XFS online repair on a system that has the exposed code path. The CVSS score of 5.5 indicates moderate severity. The EPSS score is less than 1 %, meaning exploitation probability is low, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the defect can cause critical file system corruption for affected systems, especially if an attacker can trigger or influence online repair operations.