The flaw arises when the Btrfs file system attempts to create a space information subgroup and the initialization of the associated kernel object fails. In this error path the subgroup structure is freed twice: first by the caller and again by the release callback. This double free causes kernel memory corruption, which can result in a kernel crash or, in the worst case, uncontrolled memory modification. The vulnerability is identified as CWE‑1341 and CWE‑415, demonstrating improper handling of resources during error cleanup. The CVE description contains no evidence of privilege escalation or remote exploitation.

The issue exists in all Linux kernel releases that do not yet include the patch commits referenced in the advisory (e.g., 14b22be1dd844383eb03af9b1ee3b6b25d32af ...). Distributions shipping those kernel versions remain vulnerable until they update to a kernel that incorporates the fix.

The CVSS score of 7.0 classifies the flaw as high‑severity, indicating a significant risk to kernel stability. However, the EPSS score of <1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, so no active exploits are known. The CVE description does not provide evidence that this double free can be triggered remotely or result in exploitation. Consequently, the risk remains limited to a high‑severity kernel memory corruption scenario, potentially leading to a kernel crash, but with a low probability of exploitation.