The Linux kernel contains a flaw in the UFS filesystem module where the root directory entry is installed before the cylinder group metadata is loaded during mounting. If reading the first cylinder group fails, the superblock is freed while the root entry remains, and subsequent cleanup dereferences a NULL pointer. This results in a kernel oops, effectively crashing the system.

All Linux kernel installations that enable the UFS filesystem module are affected, regardless of specific version. The flaw exists in the implementation of ufs_fill_super and the associated cylinder group handling routine. Systems that routinely mount UFS images—such as legacy file systems, embedded devices, or custom kernels—are at risk if the unpatched module is in use.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is below 1%, reflecting a very low but nonzero probability of exploitation, and the vulnerability is not listed in CISA KEV. The attack vector is likely local: an attacker must mount a crafted UFS image whose first cylinder group cannot be read, which typically requires local or elevated privileges. When such a mount is attempted, the kernel crash occurs during teardown, producing a denial of service that can lead to a system reboot or halt.