The Linux kernel's exfat_find_dir_entry() function contained a use-after-free vulnerability where the buffer_head (bh) obtained from exfat_get_dentry() was released via brelse(bh) before the directory entry pointer (ep) was fully dereferenced in the TYPE_EXTEND branch. This could cause a stale pointer dereference since brelse() drops the reference to the underlying page backing bh->b_data, which ep points into. The vulnerability was confirmed with kernel sanitizers (KASAN, DEBUG_PAGEALLOC, PAGE_POISONING) using a crafted exFAT image that forced the vulnerable code path. The fix involved moving brelse(bh) to after all uses of ep, preventing the use-after-free. This is a memory safety fix similar to a prior fix in exfat_load_upcase_table().

This vulnerability could lead to a kernel crash or memory corruption due to use-after-free in the exFAT filesystem driver. While no exploits in the wild are known, exploitation could cause denial of service or potentially escalate privileges if leveraged in a crafted exFAT image scenario. The issue affects kernel stability and security when mounting or accessing specially crafted exFAT filesystems.

A fix for this vulnerability has been applied to the Linux kernel source code. Users and administrators should update their Linux kernel to a version that includes this patch to eliminate the use-after-free condition in exfat_find_dir_entry(). Patch status is confirmed by the description of the fix; no additional mitigation is required beyond applying the official kernel update.