The vulnerability is a flaw in the XFS file system’s recovery logic for unlinked inode buckets. The code fails to clear a reference after it is released, which can create a use‑after‑free condition when the inode garbage‑collector flush operation fails. Other defects introduce memory leaks and self‑referencing pointers that can form loops in the unlinked list. An attacker able to trigger the garbage‑collection flush path could corrupt kernel memory, potentially leading to arbitrary code execution or a kernel panic.

All Linux kernel versions that include the XFS file system and compile the xlog_recover_iunlink_bucket routine are impacted. No precise version range is supplied; the issue is identified by the generic Linux kernel product label. Distributions shipping a kernel that uses the unpatched XFS code are potentially affected.

The CVSS score is 7.8 and the EPSS score is <1%. The flaw is not listed in CISA’s KEV catalog. Exploitation would require triggering a failure in the inode‑gc flush path, suggesting a somewhat constrained local attack vector. Given the high severity score, the potential impact remains significant, but a successful exploit could still allow denial of service or local privilege escalation to root.