The kernel’s Btrfs LZO decompression routine mishandles validation of inline extents that contain only an LZO header with no segment header or payload. When the decompression routine attempts to read a missing segment header, it performs a slab-out-of-bounds read that is caught by KASAN, leading to a kernel panic. The flaw does not execute arbitrary code but causes a denial of service by crashing the system or the process performing the read. This represents an out-of-bounds memory read due to invalid input validation of compressed file extents.

All Linux kernel releases that implement Btrfs with the LZO inline compression path are affected. No specific kernel version range is listed, so any system running the unpatched Btrfs LZO code should assume risk until a patch is applied.

Based on the description, it is inferred that the vulnerability can be exploited when an attacker supplies a crafted Btrfs filesystem image or file containing an incomplete inline LZO extent. The CVSS score is 9.8 and the EPSS score is < 1%, so the formal severity rating is high and the exploitation probability is very low. Therefore the flaw is exploitable in scenarios where the attacker can control the filesystem image, such as mounting a malicious image or reading a file from it. The low EPSS score suggests a lower likelihood of mass exploitation, and the issue is not listed in the CISA KEV catalog.