This vulnerability arises because the Btrfs filesystem driver fails to initialize inode mapping flags properly when a cached inode is re‑loaded after a cache drop. The minimal folio order remains set to 0 instead of the required value for the file system’s block size. When subsequent page cache reads request a folio, the mismatch in size triggers an assertion in extent_io.c and causes a kernel panic. The result is an abrupt system halt that can be exploited to deny service to a user or system.

All Linux kernels that include the Btrfs driver before the upstream patch that updates btrfs_update_inode_mapping_flags() and btrfs_set_inode_mapping_order() is merged. The vulnerability was demonstrated against a custom 7.2.0‑rc5 build, but any kernel that ships the affected commit and has not yet applied the fix will be vulnerable. This includes any distribution that distributes the kernel as shipped without the patch.

The CVSS score is not provided, and EPSS data is unavailable, so a precise numerical risk assessment cannot be given. No CISA KEV listing indicates that the vulnerability is currently exploited in the wild. The likely attack vector is local: an attacker with write access to the Btrfs filesystem (for example through a privileged process or a vulnerable application) can trigger cache drops and reuse the same inode, setting up conditions that result in a kernel panic. Because the fault leads to a crash, it functions as a denial‑of‑service vector rather than a privilege escalation or data exfiltration.