The vulnerability manifests as an unreferenced object leak in the kernel’s btrfs file system. The leak occurs in btrfs_do_encoded_write(), where a 64‑byte extent changeset allocation is not released before the function returns. While the flaw does not enable code execution or privilege escalation, the leaked memory can accumulate over time, reducing available kernel memory and potentially causing crashes or degraded performance. The impact is therefore a denial‑of‑service type condition that only affects system stability.

The problem is confined to the Linux kernel’s btrfs module. It was discovered in kernel 6.12.94 during local fuzzing, but the code path exists in all earlier kernels that omit the patch. All systems running a kernel that includes the unpatched btrfs_do_encoded_write() routine are affected, regardless of operating system distribution. Users should verify whether their kernel release predates the patch that frees the extent changeset before returning.

The CVSS score of 5.5 classifies the issue as moderate severity. The EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. Attackers would need local write access to a btrfs mount and would have to perform repeated write operations to exhaust kernel memory. The vulnerability is not listed in the CISA KEV catalog, and the exploit vector is purely local, limiting the risk to systems with compromised local users.