The defect resides in the Linux kernel’s btrfs module and occurs when an inline extent cannot be allocated due to insufficient space. In this scenario the code mistakenly frees the qgroup reservation that will later be used in the fallback copy‑on‑write path. This incorrect free leads to a mismatch between the reservation bookkeeping and the actual data usage, which can cause allocation errors, corrupted file‑system metadata, or loss of user data. The likely attack vector is inferred from the description: an attacker would need the ability to generate a write that fails because the filesystem is out of space, which typically requires local or privileged access to the affected system.

All Linux kernel releases containing the unpatched btrfs implementation, including kernel 6.19 rc1 through rc4 and earlier mainline kernels. The vulnerability applies to the generic Linux kernel product; any system running a kernel with btrfs before the patch commit is potentially affected.

The CVSS score of 7.5 indicates a high‑impact flaw, while the EPSS score of less than 1% and absence from CISA’s KEV catalog suggest that exploitation is currently uncommon. The flaw is triggered only when a write operation to a btrfs volume fails due to an out‑of‑space condition, meaning an attacker would need local or privileged access to create such a failure scenario. As of now, there is no evidence of active exploitation.