The vulnerability arises in the Linux kernel’s Btrfs file system when LZO compression is used. During decompression, the kernel function lzo_decompress_bio validates each on‑disk segment length (seg_len) only against the size of the workspace buffer, not against the actual compressed input length (compressed_len). A crafted extent can therefore contain a segment that appears valid for the buffer but actually extends beyond the compressed data. When copy_compressed_segment() copies this segment, it reads past the end of the bio, causing a null pointer dereference that leads to a kernel crash and a denial of service. The bug is detected by KASAN with a null‑ptr‑deref at address 0x0, revealing an out‑of‑bounds read and subsequent kernel panic.

Any Linux kernel that includes the Btrfs file system and supports LZO compression is potentially affected. The available data does not list specific kernel versions or distributions, so all releases that ship the Btrfs LZO decompression path should treat this as a vulnerability until a patch is applied. The Git kernel commits referenced in the advisory (1641d058adfbd50cf95d54581ed5d142ee82c07f and b0d27d43791b7a3057c3c4aedf9b4aa033d37c46) contain the resolution code.

The Common Vulnerability Scoring System (CVSS) score was not provided, and the exploit probability score (EPSS) is not available, so the exact severity cannot be quantified from the supplied data. However, the bug results in a null pointer dereference that causes a kernel panic, indicating a high potential impact. The vulnerability requires the attacker to supply a malicious LZO‑compressed extent, which typically means local privileged access or control over a file written to the Btrfs volume. The lack of a KEV listing suggests no widely observed exploitation at the time, but the technical characteristics make local exploitation relatively straightforward if an attacker can craft or direct a corrupt extent to the file system.