This vulnerability occurs in the Linux kernel XFS filesystem code when a chown operation on an orphanage directory inode fails. The failure path incorrectly retains an igrab'd reference to the inode, allowing a kernel reference leak. While the leak is internal to the kernel and not directly exposed to user space, it can lead to an unnecessary retention of resources, which over time could exhaust kernel memory and potentially trigger service disruption.

Affected systems include any Linux kernel utilizing the XFS filesystem that has not applied the upstream fix referenced in the advisories. No specific kernel release is listed in the advisory, so all current kernels before the patch are considered vulnerable.

The EPSS score is < 1%, indicating a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The CVSS score is 2.3, so the precise severity cannot be quantified from the data. Based on the description, the primary risk is a kernel resource leak that could lead to denial of service; direct code execution or privilege escalation is not described. Exploitation would require triggering the specific chown failure path in an XFS orphanage directory, a scenario that may be accidental or caused by misadministration. The probability of exploitation, absent public evidence, appears low but is mitigable by updating the kernel.