A local user who owns a Btrfs subvolume can trigger an item overflow by repeatedly invoking the set received ioctl with the same UUID. Prior to the fix, the kernel started a transaction before checking for overflow, and when the overflow occurred the transaction aborted, forcing the entire filesystem into read‑only mode. This overflow is an example of integer overflow (CWE‑191) and memory allocation overflow (CWE‑770). The applied fix performs an early check for item overflow before starting the transaction, preventing the abort and keeping the filesystem operational. This flaw allows a non‑elevated user to disrupt availability of the file system rather than compromising confidentiality or integrity.

This issue affects all recent releases of the Linux kernel that include the Btrfs filesystem driver. Any system running a kernel that is built with btrfs support and allows subvolume ownership is potentially impacted. The affected product is the Linux operating system kernel, all distributions that ship it by default.

The vulnerability requires local access and ownership of a Btrfs subvolume; no administrative privileges are necessary. Because the exploit path involves a simple ioctl call that can be performed by any subvolume owner, the risk is considered moderate. Exploitation would result in a denial of service for all users on the affected mount point. The EPSS score of < 1% indicates a very low probability of exploitation, and the CVE is not listed in the CISA KEV catalog. With a CVSS score of 5.5, this vulnerability is considered medium severity. The attack vector is local and does not traverse a network boundary. No publicly documented exploit code exists at this time.