A path in the Btrfs file‑system code a direct write into a NOCOW range fails. The reference is never released on the error return path, causing memory objects to persist and accumulate. Repeated failures can lead to kernel resource exhaustion, potentially triggering memory pressure, system instability, or crash.

All Linux kernel distributions that ship unpatched Btrfs code are affected. The specific version ranges are not enumerated, so any kernel before the commit that introduced the fix may be vulnerable. The impact applies to systems that use Btrfs filesystems containing NOCOW ranges.

The CVSS score of 5.5 denotes moderate severity, and the EPSS of <1% indicates a very low probability of exploitation in the wild. No public exploitation is reported and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires local or elevated privileges to initiate direct I/O writes into a NOCOW range, a capability typically available to root or processes with CAP_DAC_OVERRIDE. An attacker would need the ability to trigger repeated write failures along the vulnerable path to exhaust kernel resources.