The vulnerability arises in the Linux kernel’s Btrfs file system when LZO compression is used. During decompression, the kernel function lzo_decompress_bio validates each on‑disk segment length (seg_len) only against the size of the workspace buffer, not against the actual compressed input length (compressed_len). A crafted extent can therefore contain a segment that appears valid for the buffer but actually extends beyond the compressed data. When copy_compressed_segment() copies this segment, it reads past the end of the bio, causing a null pointer dereference that leads to a kernel crash and a denial of service. The bug is detected by KASAN with a null‑ptr‑deref at address 0x0, revealing an out‑of‑bounds read and subsequent kernel panic.

Any Linux kernel that includes the Btrfs file system and supports LZO compression is potentially affected. The available data does not list specific kernel versions or distributions, so all releases that ship the Btrfs LZO decompression path should treat this as a vulnerability until a patch is applied. The Git kernel commits referenced in the advisory (1641d058adfbd50cf95d54581ed5d142ee82c07f and b0d27d43791b7a3057c3c4aedf9b4aa033d37c46) contain the resolution code.

The Common Vulnerability Scoring System (CVSS) score is 7.5, and the exploit probability score (EPSS) is less than 1%, indicating a high severity but a very low likelihood of exploitation in the wild. However, the bug results in a null pointer dereference that causes a kernel panic, indicating a high potential impact. The vulnerability requires the attacker to supply a malicious LZO‑compressed extent, which typically means local privileged access or control over a file written to the Btrfs volume. The lack of a KEV listing suggests no widely observed exploitation at the time, but the technical characteristics make local exploitation relatively straightforward if an attacker can craft or direct a corrupt extent to the file system.