The flaw occurs in the Linux kernel’s btrfs file system when an operation attempts to create an inline extent but fails because of insufficient space. The fallback path then reserves an extent on the underlying transactional system. In the buggy code, the reserved qgroup data is freed even though the data will still be needed, leading to a mismatch between the reservation bookkeeping and the actual data usage. This inconsistency can cause downstream allocation errors or corrupt file system metadata, potentially resulting in loss or corruption of user data.

All Linux kernel releases that contain the btrfs implementation prior to the patch commit. The vulnerability is associated with the generic Linux kernel product; no specific vendor‑product name or version range is listed in the CNA data. Both Linux vendor listings indicate that the issue exists within the mainline kernel source.

The CVSS score of 7.0 indicates moderate severity, while the EPSS score of less than 1% and absence from the CISA KEV catalog suggest that widespread exploitation is unlikely at present. The flaw is only triggered during normal write operations to a btrfs volume, so it would likely require the attacker to have at least local or privileged access to issue writes that exhaust a file system’s space. This inference is derived from the description of the runtime behaviour and the need for a write path that triggers the fallback.