A flaw in the UFS implementation causes cylinder group metadata to be cached from disk without validation. The cached indices and rotor values are then used directly as offsets when allocating and freeing space. A crafted UFS image can set these values to arbitrary, out‑of‑range values, turning a normal allocation into an out‑of‑bounds read or write. This uncontrolled memory manipulation can corrupt kernel data structures, potentially allowing an attacker to gain elevated privileges, execute arbitrary code, or crash the system.

All Linux kernel builds that include UFS support are potentially affected until a kernel update that implements the metadata‑validation logic is installed. Any system that mounts a UFS filesystem from a device containing malformed metadata, such as a corrupted image or a malicious filesystem, is exposed. The vulnerability applies to all kernel versions prior to the patch, across all architectures that support UFS.

The CVSS score of 7 indicates moderate‑to‑severe risk. The EPSS score is less than 1%, suggesting a low probability of exploitation at the time of this analysis. This vulnerability occurs in privileged kernel code, so a local attacker with the ability to mount a crafted UFS filesystem—typically requiring root privileges or administrative access—is the most direct threat. The likely attack vector is local mounting of a malicious image, as the description does not explicitly state remote exploitation. Remote exploitation would only be possible if an attacker could influence the mounting of a UFS volume over a network share or supply a malicious filesystem image to a system that auto‑mounts untrusted media, which is less probable.