The vulnerability is in jbd2_journal_initialize_fast_commit() where a bounds check uses unsigned subtraction: (journal->j_last - num_fc_blks < JBD2_MIN_JOURNAL_BLOCKS). When num_fc_blks exceeds j_last, the subtraction underflows to SIZE_MAX, which is always less than the threshold — the check passes when it should fail. The fix requires checking num_fc_blks > j_last before performing the subtraction.
The trigger conditions are narrower than they first appear: exploitation requires a specific journal state where num_fc_blks exceeds j_last, which can only be set from userspace during fast commit initialization. However, the failure scope far exceeds the trigger scope. Once j_last, j_fc_first, or j_free become unreliable due to corrupted arithmetic, journal abort propagates to the entire filesystem — every process with an open handle loses durable write guarantees, and every inode depending on that journal loses consistency guarantees. This isn't a fast commit failure; it's a failure of the transaction integrity mechanism the entire journal exists to provide. An unprivileged attacker needs only one malformed fast commit block count to deny writes to all users on the mounted volume.
The EPSS score understates the risk because it models probability of direct exploitation, not the probability that a future unrelated change creates a new trigger path into the already-corrupted journal state. The underflow condition sits dormant in initialization code that runs once per journal lifetime, waiting for the right runtime state.
The systemic lesson: this pattern has appeared across the kernel repeatedly (CVE-2016-3955, CVE-2018-10883, CVE-2021-43389) with trivial fixes each time. Institutional memory doesn't generalize — developers learn 'check before subtract' for specific variables, not for the vulnerability class. The fast commit path likely inherited unsigned types from pre-existing jbd2 struct fields, and the bug emerged when someone wrote a subtraction-based bounds check against those fields without considering underflow. The types were safe; the composition was not. Bounds checks in initialization paths deserve both static analysis flags and runtime assertions, because the precondition state space is only fully exercised at mount time with real media.