In the Linux kernel’s btrfs filesystem, an unexpected reloc_root in the merge_reloc_roots function causes a missing btrfs_put_root() call, leaving a reference unreleased. This results in a memory leak that can grow over time, potentially exhausting system resources and causing a denial‑of‑service condition. The vulnerability does not directly expose data or allow integrity or confidentiality compromise.

All Linux kernel versions that include the btrfs filesystem and the merge_reloc_roots code path are affected. No specific version range is listed, so the fix applies generally to all installations containing this code.

The EPSS score (< 1%) and the CVSS score of 5.5 indicate a low exploitation probability, and the CVE is not listed in CISA KEV. Based on the description, it is inferred that local kernel‑level access is required to trigger the code path, representing a local attack vector with no remote exposure. Without kernel compromise, the vulnerability is unlikely to be exploited, and the impact is moderate mainly due to potential DoS from resource exhaustion.