The vulnerability is a NULL pointer dereference in the Btrfs file system’s log replay routine. During recovery from a corrupted or incomplete log, the code attempts to print debugging information and unconditionally dereferences a pointer that may be NULL, which can cause a kernel panic and lead to a system-wide denial of service. This weakness is a classic pointer validation failure and does not grant code execution or privilege escalation, but a crash can disrupt any user with kernel access.

All Linux kernel versions that include the Btrfs file system and have not yet incorporated the fix that guards the dereference in do_abort_log_replay() are affected. The CNA does not supply specific version ranges, so the impact covers any Linux kernel release before the one that includes the patch. Users running unpatched kernels that rely on Btrfs should verify whether they are running the vulnerable code path.

The CVSS score of 5.5 reflects a medium severity, while the EPSS score of less than 1 % indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local or requires elevated privileges to manipulate Btrfs metadata or intentionally trigger a replay failure. Existing patches add a NULL check to prevent the crash; systems that have not applied the fix remain vulnerable to a condition that may cause a kernel panic.