A calculation error in the Btrfs subsystem’s qgroup_free_reserved_data function incorrectly rounds up the end position, which results in an overestimation of the length used later in the code. This miscalculation can corrupt kernel memory, potentially allowing an attacker to execute arbitrary code or trigger a denial‑of‑service by crashing the system.

The vulnerability affects the Linux kernel’s Btrfs implementation, specifically the qgroup module. No specific kernel release numbers are listed in the advisory; however, the fix is included in the referenced commit series and should be present in later kernel releases.

The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting a low current exploitation probability. Nevertheless, kernel memory corruption is a highly severe issue; an attacker would typically need local access or a method to trigger the vulnerable path. No public exploits have been reported at this time.