The vulnerability arises when the Btrfs filesystem fails to update the last_unlink_trans field after a directory removal. This oversight allows a stale field to persist, which can be propagated to subsequent fsync operations that occur on the now-removed directory’s file descriptor. The consequence is data corruption during log replay when the filesystem is remounted, often manifested as an EIO error and a failure to mount the filesystem, potentially leading to loss of data and service disruption. The weakness can be classified as improper initialization or state update, corresponding to CWE‑665.

All Linux kernel distributions that include the Btrfs filesystem are affected, as the issue resides in the core kernel code. Any system running a kernel version prior to the commit that fixes the missing last_unlink_trans update (see the provided git references) is susceptible, regardless of the vendor.

While the EPSS is not available and KEV is not listed in the CISA KEV list, the CVSS score is not listed, the nature of the flaw suggests a high severity impact on data integrity if triggered. The exploit requires that a process holds an open file descriptor on a directory and then removes that directory; power loss or a forced system crash during this window can trigger the corruption. The attack vector appears to be local or physical, as it depends on filesystem operations performed by a user or process with sufficient privileges. Because the flaw does not expose a straightforward remote exploitation path, the likelihood is low, but the potential damage is significant.