A defect in the Linux kernel b_pages io tree to be released even when a write operation had failed, leaving unsubmitted extent buffers in the tree. The clean‑up path then attempts to free buffers that were never appropriately written, producing a cascade of kernel warnings and forcing the filesystem into a readonly state. This flaw can lead to loss of write progress, potential data corruption during unmount, and reduced filesystem reliability, though it does not provide direct remote or local privilege escalation.

The issue exists in versions of the Linux kernel that compile the btrfs filesystem, including custom kernels such as 7.1.0-rc1-custom+ and likely earlier releases that have not applied the patch commit “4066c55e109475a06d18a1f127c939d551211956”. Any deployment using btrfs without the fix may experience the described warnings and errors when unmounting or performing intensive write workloads.

The vulnerability is non‑remote and requires local interaction with a filesystem using btrfs that experiences failed writes. The probability of exploitation is low to moderate because an attacker must invoke a specific write failure path. No CVSS or EPSS scores are provided, and the flaw is not listed in CISA’s KEV catalog, indicating limited proven exploitation. Nonetheless, the impact on data integrity warrants immediate attention.