The vulnerability arises in the Linux kernel’s Btrfs filesystem when creating space_info sub‑groups. The code fails to remove the kobject name entries on deallocation, which leaks name strings. This is a CWE‑911 weakness involving inadequate deallocation of name objects. The leak is manifested as orphaned memory that can accumulate over time and potentially exhaust kernel memory.

All Linux kernel deployments that include the Btrfs filesystem and expose the space_info structure are affected, regardless of distribution. The leak can manifest in any kernel version prior to the patch commit referenced in the advisory. Systems built with the CONFIG_DEBUG_KMEMLEAK option are especially useful for detecting the leak, but dynamic memory pressure can occur in normal operation as well.

The advisory does not provide a CVSS score. The EPSS score is < 1%, indicating a very low chance of active exploitation. The vulnerability is not in CISA’s KEV catalog. The leak can accumulate as many space_info objects are created, which may occur during normal Btrfs operation or specific workloads that heavily use the space_info structure. No public exploitation has been documented, but the potential for memory exhaustion remains.