The vulnerability exists in the Linux kernel’s Btrfs subsystem, specifically when the btrfs_drop_extent_map_range() function splits an extent map. Due to a change in how the EXTENT_FLAG_LOGGING flag is handled, the flag is copied to the new split extent map and never cleared. When that split map is later freed while still present on the inode’s modified_extents list, a WARN_ON check fails and triggers a use‑after‑free inside btrfs_free_extent_map(). This can lead to a kernel crash or, if an attacker can control the split operation, to execution of arbitrary code at the kernel level.

All Linux kernel builds that include the Btrfs filesystem and lack the commit that removes the EXTENT_FLAG_LOGGING flag from split extent maps are affected. The CVE data does not list a specific kernel version range, so any distribution shipping an unpatched kernel is potentially vulnerable.

The CVSS score of 7.8 indicates a high‑risk vulnerability, while the EPSS score of less than 1 % and absence from the CISA KEV catalog imply a low likelihood of exploitation. The flaw is a classic use‑after‑free combined with improper flag handling (CWE‑825). An attacker with local or privileged access who can trigger btrfs_drop_extent_map_range() on a logged extent may cause a kernel panic or elevation of privileges, but no publicly available exploit is documented at this time.