The vulnerability allows a user to bypass XFS quota enforcement by changing a file's group ID through an NFS client. Because the kernel checks real credentials with has_capability_noaudit() instead of the effective credentials checked by capable(), a user can manipulate file attributes that normally trigger quota checks. This enables a file to grow beyond its hard quota limit, consuming disk space that should have been reserved for other users or processes. While it does not provide remote code execution, the impact is significant integrity and availability degradation if the disk becomes full or if other services are denied space.

Any Linux system that runs the Linux kernel with the XFS file system module enabled is vulnerable if the kernel predates the patch commit eba0549bc7d1. All distributions that ship an unpatched XFS quota implementation, regardless of kernel release, are affected until the kernel is updated.

The CVSS score is not published and the EPSS score is unavailable, so the precise exploitability cannot be quantified. The flaw can be exploited by a local user or by anyone able to mount an NFS share to the affected server; by changing the group ID of a large file the attacker can cause the quota code to apply the XFS_QMOPT_FORCE_RES flag, bypassing quota accounting. No public exploits are known and the issue is not listed in CISA KEV, but the ease of triggering the vulnerability through file attribute manipulation makes it a moderate to high risk for affected hosts.