In the btrfs filesystem, the kernel fails to log new directory entries when it logs the parent directory of a conflicting inode. If the parent directory is later fsynced, the filesystem records it as up‑to‑date without recording those new entries. After a power failure, the log replay restores the filesystem but the missing entries are never recreated, leading to disappearance of directories or files and resulting in data loss or corruption. This defect relates to CWE‑821; the NVD also lists it as NVD‑CWE‑noinfo, which indicates a lack of specific CWE mapping beyond the primary CWE‑821 for improper control over resource processing order. While the vulnerability does not provide remote code execution, it can be triggered by a local or privileged user who creates new files or directories, then performs an explicit fsync on a parent directory, and subsequently forces a power failure. The lack of an active exploit record and absence from CISA’s KEV list suggest current exploitation is limited but the risk remains moderate.

Linux kernel implementations that use the btrfs filesystem are affected. The vulnerability applies to any distribution shipping a kernel that contains the buggy btrfs code. No specific kernel versions are listed, so all current kernels that have not yet received the patch may be vulnerable.

The medium CVSS score of 5.5, the EPSS score of <1 % indicating a very low exploitation probability, and the lack of inclusion in the CISA KEV catalog together suggest that exploitation is unlikely. The risk is limited to local or privileged users who can create new entries, fsync parent directories, and force a power failure. No public exploits are known, but the potential for permanent data loss persists, warranting timely remediation.