The vulnerability originates in the Btrfs filesystem’s handling of dirty metadata. An internal threshold of 32 MiB prevents Btrfs from writing back dirty btree inode pages until that limit is exceeded, while the cgroup memory controller throttles tasks to a much lower limit for small cgroups. When a task dirties more than the cgroup allows – for example 28 MiB of btree pages – the task is forced to sleep in balance_dirty_pages() awaiting a writeback that cannot occur. This deadlock causes the process to wait indefinitely, eventually leading to a kernel core dump and a system hang. The impact is a denial of service at the system level, where normal operations can be halted by a local or privileged process that triggers excessive Btrfs metadata writes.

Vulnerable Linux kernels include all upstream releases from 6.4 up to but excluding 6.18, including the 6.19 release candidate series (6.19rc1 through 6.19rc7). Any system running these kernels on a filesystem using the Btrfs filesystem is affected. The issue is tied to the Linux:Linux vendor.

The CVSS score is 5.5, indicating moderate severity, and the EPSS score is reported as less than 1 %, implying a very low probability of exploitation under normal circumstances. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is most likely local or privileged, as the deadlock requires a process capable of creating large Btrfs metadata writes within a constrained cgroup. No public exploit has been demonstrated, but any process that can trigger the btree_writepages() path on a small‑memory cgroup could reproduce the hang.