The vulnerability arises when the Btrfs filesystem fails to update the last_unlink_trans field after a directory removal. This oversight allows a stale field to persist, which can be propagated to subsequent fsync operations that occur on the now‑removed directory’s file descriptor. The consequence is data corruption during log replay when the filesystem is remounted, often manifested as an EIO error and a failure to mount the filesystem, potentially leading to loss of data and service disruption. The weakness can be classified as improper initialization or state update, corresponding to CWE‑911.

All Linux kernel distributions that include the Btrfs filesystem are affected, as the issue resides in the core kernel code. Any system running a kernel version prior to the commit that fixes the missing last_unlink_trans update (see the provided git references) is susceptible, regardless of the vendor.

While the EPSS score is below 1% and KEV status show no listing, the CVSS score of 5.5 indicates a moderate severity impact on data integrity if triggered. The exploit requires a process to hold an open file descriptor on a directory that is then removed; a power loss or forced system crash during this window can trigger the corruption. The likely attack vector is local or physical, based on the need for a user or process to perform filesystem operations such as rmdir on a directory with an open file descriptor; this inference is made from the description as the flaw does not provide a remote access path. Because the flaw does not expose a straightforward remote exploitation path, the likelihood is low, but the potential damage is significant.