In the Linux kernel’s btrfs filesystem, a failure to validate a root_item invariant permits an invalid combination of drop_progress.objectid and drop_level. When a snapshot drop is left incomplete, the kernel preserves a resume point with non‑zero drop_progress; however, it requires drop_level to be non‑zero. If metadata is corrupted so that drop_progress.objectid is non‑zero while drop_level is zero, the recovery code merge_reloc_root() will trigger BUG_ON(level == 0), causing a kernel panic and immediate loss of system availability. The bug does not provide a code execution path or privilege escalation, but it results in a denial‑of‑service by crashing the system.

All Linux kernel releases containing the btrfs implementation prior to the commit that added root_item validation are affected. The issue was discovered in the 7.0.0‑rc2‑next‑20260310 development kernel and is likely present in all earlier stable releases that have not applied the fix. Systems using btrfs filesystems on unsafely patched kernels are at risk.

The CVSS score is 5.5, and the EPSS score is < 1%, so the exact severity metrics are unknown. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must be able to corrupt btrfs metadata on a device, typically via local or privileged write access to the filesystem. Once such malformed metadata is present on disk, the next mount or snapshot recovery will trigger a kernel panic. Thus the primary risk is a denial‑of‑service, with no documented remote exploitation route.