In the btrfs filesystem, the kernel fails to log new directory entries when it logs the parent directory of a conflicting inode. If the parent directory is later fsynced, the filesystem records it as up‑to‑date without recording those new entries. After a power failure, the log replay restores the filesystem but the missing entries are never recreated, leading to disappearance of directories or files and resulting in data loss or corruption. This defect relates to CWE‑821, which concerns improper control over the order in which resources are processed. While the vulnerability does not provide remote code execution, it can be triggered by a local or privileged user who creates new files or directories, then performs an explicit fsync on a parent directory, and subsequently forces a power failure. The lack of an active exploit record and absence from CISA’s KEV list suggest current exploitation is limited but the risk remains moderate. The CVSS score of 5.5 places the issue in the medium severity range, and the lack of EPSS data means its exploitation likelihood cannot be quantified. Nonetheless, because the bug can permanently remove filesystem entries, it poses a tangible threat to data integrity.

Linux kernel implementations that use the btrfs filesystem are affected. The vulnerability applies to any distribution shipping a kernel that contains the buggy btrfs code. No specific kernel versions are listed, so all current kernels that have not yet received the patch may be vulnerable.

The medium CVSS score, absence from the KEV catalog, and the need for localized control (creating new entries, fsyncing a parent directory, and causing a power loss) make exploitation limited to local or privileged attackers. No public exploits have been reported. Nevertheless, the potential for permanent data loss warrants timely remediation.