A time‑of‑check to time‑of‑use race exists in the function btrfs_ioctl_space_info. The routine first counts entries to size a buffer, then releases a rwlock, allowing concurrent block group removal to reduce that count. A second pass fills fewer entries than were counted and the kernel copies the full alloc_size bytes, including uninitialized kmalloc data, to user space. The description does not state the privilege level required to trigger the ioctl, but it is inferred that a local user with access to the Btrfs filesystem and its ioctl interface could potentially trigger the race, leading to an information leak. The weakness is owed to a race condition that leads to an information leak.

The vulnerability affects the Btrfs implementation in the Linux kernel on all distributions that ship the kernel and enable the Btrfs module. No specific kernel version is enumerated, but the fix is present in newer patches. The vendor affected is Linux:Linux.

Exploitation of the race may be possible when an ioctl space_info command is invoked against a btrfs file system. The description does not specify the privilege level required; it is inferred that a local user with access to the relevant ioctl could trigger the race, but the flaw may also be exploitable by processes with higher permissions. The race requires a concurrent block group removal between the two passes, which could occur during normal filesystem activity. The CVSS score of 4.7 and an EPSS score of <1% indicate moderate severity with low likelihood of exploitation. The issue is not listed in the CISA KEV catalog, so it is not a widely observed exploit.