A flaw in the Linux kernel’s Btrfs filesystem causes the __btrfs_run_delayed_refs loop to attempt a spin‑lock on an error pointer returned by btrfs_select_ref_head when the function returns –EAGAIN. This results in an invalid pointer dereference (CWE‑476), crashing the kernel and rebooting the system. The weakness is an instance of null pointer dereference, leading to a local denial of service by forcing a kernel panic.

The vulnerability affects any Linux kernel release that incorporates the refactored __btrfs_run_delayed_refs loop without the missing null check. It is present in builds that include the commit 0110a4c43451 or older patches before the fix. Since no specific version ranges are supplied, all kernel versions that still contain the problematic loop should be considered at risk until updated.

The CVSS score of 7.5 indicates a high impact. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, implying no known widespread attacks. Exploitation would likely require local or privileged access to a system using the affected Btrfs implementation to trigger the faulting path. The result is a kernel crash, so the primary risk is a local denial of service rather than remote compromise.