The bug in the Linux kernel involves an overly large memcpy operation when formatting on‑disk rtrefcount btree roots. Because only one set of keys exist in node blocks, the code copies more bytes than the buffer can hold, corrupting adjacent memory. This memory corruption can lead to silent data loss, kernel crashes, or potentially arbitrary code execution if an attacker can control the contents of the buffer or the surrounding memory.

The vulnerability is present in all Linux kernel releases that include the XFS filesystem before the patch was applied. Affected vendors are Linux distributions that ship the upstream kernel. Users should check their kernel version against the commit that introduced the fix – the referenced commits in the advisory provide the exact change and its location in the code tree.

No EPSS score is available and the flaw is not listed in CISA KEV, so the public explosion data is limited. The flaw is a local kernel reliability issue that requires privileged access to a system running the affected kernel. Based on the description, the attack vector is inferred to be local and may be triggered by normal XFS filesystem creation or modification operations. If exploited, the memory corruption could allow an attacker with local access to gain elevated privileges or crash the system.