The vulnerability in the Linux kernel exFAT file system arises from a mismatch between how the output pointer 'uniname' advances by a fixed length per name entry and how the loop guard tracks only the accumulated name length, which can be smaller if name fragments contain early null characters. This allows crafted directories with many short name fragments to cause 'uniname' to advance beyond the allocated buffer, resulting in out-of-bounds read and write operations. This flaw was fixed in Linux kernel updates released by Ubuntu in their security notices USN-8726-1 and USN-8727-1.

Successful exploitation can cause out-of-bounds memory read and write, potentially leading to memory corruption. The CVSS 3.1 score is 7.8 (High impact on confidentiality, integrity, and availability). This could allow a local attacker with some privileges to compromise system integrity or cause denial of service. No known exploits in the wild have been reported.

A patch is available and should be applied by updating the Linux kernel to the fixed versions as specified in the Ubuntu security advisories USN-8726-1 and USN-8727-1. After updating, a system reboot is required. Due to ABI changes, third-party kernel modules must be recompiled and reinstalled. No additional mitigation is required beyond applying the official updates.