Impact
A bug in the Btrfs filesystem implementation can be triggered by creating multiple files whose names produce the same CRC32C hash value. When the number of colliding entries exceeds an internal leaf size limit, the filesystem aborts the current transaction; this causes the entire filesystem to switch to read-only mode. The attacker does not need administrative privileges, and the required steps involve ordinary file creation operations. As a result, the system can no longer perform write operations on that filesystem, effectively denying service to any processes that rely on it.
Affected Systems
All Linux kernel releases that include the unpatched Btrfs implementation are affected. The vulnerability exists in the core Btrfs codepath that handles name hashing and transaction creation. It applies to any distribution or OEM that ships with the default Linux kernel and its standard Btrfs support before the fix commit is merged into the source tree.
Risk and Exploitability
The CVSS score for this issue is 5.5. The exploit requires only local user privileges and the ability to create files on a Btrfs volume. An attacker can generate name-hash collisions to trigger a transaction abort, which forces the filesystem into read-only mode. The lack of an EPSS score leaves the exact likelihood unknown, but the resulting permanent read-only state is highly disruptive. The vulnerability is not currently listed the CISA KEV catalog.
OpenCVE Enrichment