A defect in the Linux kernel’s Btrfs file system triggers an invalid leaf access when the btrfs_quota_enable() function is called and a reference key cannot be found. The code fails to break out of the search loop at the end of the Btrfs tree, potentially dereferencing an out‑of‑bounds pointer. This can lead to a kernel crash and a loss of availability. The impact is inferred from the fact that the code continues after a missing key and the comment indicates a potential out‑of‑bounds access; the CVE data does not explicitly state a crash, but such behavior is a common consequence of this type of error.

All Linux kernel builds that include the Btrfs file system and expose the btrfs_quota_enable logic without the recent patch are affected. The flaw exists in any distribution kernel until the commit that implements the described fix, which is incorporated into newer kernel releases.

The CVSS score of 5.5 indicates medium severity, reflecting the risk of a kernel crash if the buggy path is exercised. EPSS score of <1% and the vulnerability is not listed in the CISA KEV catalog, indicating limited exploitation activity so far. Nonetheless, an attacker with sufficient privileges to modify Btrfs quotas or mount Btrfs volumes as read‑write could trigger the defect and cause a local denial‑of‑service via a kernel panic. The likely attack vector is local, requiring privileged access.