A bug in the Btrfs filesystem implementation can be triggered by creating multiple files whose names produce the same CRC32C hash value. When the number of colliding entries exceeds an internal leaf size limit, the filesystem aborts the current transaction; this causes the entire filesystem to switch to read‑only mode. The attacker does not need administrative privileges, and the required steps involve ordinary file creation operations. As a result, the system can no longer perform write operations on that filesystem, effectively denying service to any processes that rely on it.

All Linux kernel releases that include the unpatched Btrfs implementation are affected. The vulnerability exists in the core Btrfs codepath that handles name hashing and transaction creation. It applies to any distribution or OEM that ships with the default Linux kernel and its standard Btrfs support before the fix commit is merged into the source tree.

The CVSS score for this issue is 5.5. The EPSS score of < 1% indicates a very low probability of exploitation, but the impact is significant if exploited. The exploit requires only local user privileges and the ability to create files on a Btrfs volume. By generating name‑hash collisions that exceed the leaf size limit, an attacker can trigger a transaction abort, pushing the filesystem into read‑only mode. This state prevents any further writes, effectively leaving the system in a read‑only state until reboot or repair. The vulnerability is not listed in the CISA KEV catalog.