The bug in the Linux kernel’s btrfs subsystem allows an attacker to create a subvolume that ends up with a broken dentry and orphan cleanup state. When the orphan cleanup path fails, subsequent lookup operations yield negative dentries, causing file or subvolume deletions to fail with ENOENT and write attempts to overwrite the broken object to return EEXIST or abort the filesystem. This results in data loss, filesystem corruption, and a denial‑of‑service condition, because the filesystem can become unusable if attempts to modify it trigger aborts. The weakness is rooted in improper handling of the BTRFS_ROOT_ORPHAN_CLEANUP flag, leading to race conditions between subvolume creation, orphan cleanup, and inode reference release.

All Linux kernels that implement the Btrfs filesystem are impacted, as the issue is in the kernel’s core btrfs code. The vulnerability applies regardless of distribution, kernel version, or whether the system is running as a standard user or with elevated privileges, although the creation and deletion of subvolumes typically require root or administrative rights.

The attack vector is likely local with sufficient privileges to create or delete Btrfs subvolumes, as the race conditions arise during normal filesystem operations. The EPSS score is <1% and the CVSS score is 5.5, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw can cause a filesystem to abort during normal operations, its impact is significant for any system relying on Btr, potentially leading to data corruption or denial of service.