In Linux kernel erofs, the cache key for inode_share entries was created by concatenating a fingerprint string directly with a domain identifier without any delimiter, resulting in an ambiguous key that could be misinterpreted when parsed. This ambiguity may lead to incorrect cache lookups or unintended memory corruption during key processing, potentially destabilizing the kernel. The weakness is rooted in improper handling of composite key components, matching CWE‑694. Based on the description, it is inferred that an attacker could manipulate the fingerprint to cause ambiguity in cache key parsing.

The issue resides in the erofs module of the Linux kernel, affecting all kernel releases that predate the commit that added the "\0" separator between the domain ID and fingerprint. Therefore any Linux system running a kernel version before that change and that mounts erofs filesystems is potentially impacted. The vulnerability applies to all processor architectures supported by the kernel.

The CVSS score is 5.5, and the EPSS score is less than 1%; the vulnerability is not present in the CISA KEV catalog. The lack of a publicly documented exploitation path and the need to mount or manipulate erofs images suggest that exploitation would require local or privileged access. Based on the description, it is inferred that the attack vector likely requires local or privileged access. Consequently the severity is considered low to moderate and the risk to environments that use erofs is primarily a source of kernel instability rather than a direct attack vector. Administrators should treat the bug as a stability issue and prioritize relevant kernel updates.