The vulnerability causes xfs_qm_flush_one to fail to drop the dquot flush lock when it cannot acquire the associated buffer. Because the lock is never released, subsequent quota operations that require this lock block indefinitely, leading to a denial of service. The flaw is a classic race condition in the kernel and can compromise the availability of all processes relying on XFS quota management.

All Linux kernel installations that ship with the XFS quota manager are potentially affected; the CVE data does not specify an exact kernel version or distribution. No particular vendor version is listed. System administrators should verify that their running kernel includes the commit that adds the lock‑release code by checking the git patch references provided.

No exploit is currently known and EPSS data is not available; the CVE is not listed in CISA’s KEV catalog. Nevertheless the vulnerability can lead to a full system stall if an attacker or misbehaving process triggers quota management while the buffer is missing, resulting in an indefinite lock hold. Because the fault lies in the kernel, the risk is concentrated on availability and the potential impact is high.