A logic flaw in the Linux kernel Btrfs subsystem allows a local user to trigger a transaction abort by repeatedly snapshotting a received subvolume until an item overflow occurs. Once the transaction aborts, the filesystem is automatically remounted as read‑only, preventing any further writes. This denial of service can be executed without requiring elevated privileges beyond inode ownership or capability checks, meaning ordinary unprivileged users can disrupt the entire system’s write capability.

All Linux kernels that include the Btrfs driver and have not yet applied the fix for this issue are affected. The problem exists in kernel builds prior to the commit that introduced the transaction abort protection (see commit 6bce705b). No specific distribution or patch level is excluded, so any distribution using a kernel version that lacks this commit may be vulnerable.

The EPSS score is not available, and the vulnerability is not listed in CISA KEV, indicating limited evidence of widespread exploitation. The CVSS score of 7.0 indicates medium severity according to the Common Vulnerability Scoring System. However, because the vulnerability does not require special privileges and can be triggered by any user with the ability to create subvolumes, the risk of denial of service is moderate to high in environments where untrusted users have access to Btrfs filesystems. Attackers could deliberately render a critical service or system inoperable by forcing the filesystem to read‑only mode. No public exploit code is known, but the attack path is straightforward and could be automated if required.