The vulnerability arises because the Btrfs filesystem allows the initiation of new transactions even when the filesystem is mounted with rescue options, which effectively make it fully read‑only. This oversight can cause warning messages and further corruption when the filesystem is unmounted, as the kernel attempts to start a new transaction on a non‑writeable device. The primary impact is loss of data integrity and the possibility of a denial‑of‑service condition during unmount.

The affected product is the Linux kernel’s Btrfs implementation. Versions impacted include all 6.19 release candidates (rc1 through rc6) as indicated by the provided CPE list. No stable releases prior to 6.19 are known to be affected.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation under current conditions. The vulnerability is local; it requires the attacker to mount the Btrfs volume with rescue options and then unmount it, which typically requires root privileges—this is inferred from the nature of rescue mounts. Remote exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog, implying no publicly known exploits.