A flaw in the Btrfs filesystem’s merge_reloc_roots function resets the reloc_root pointer without the required memory barriers, potentially leaving concurrent kernel threads with stale or inconsistent data. This unsynchronized access can trigger a race condition that may lead to a kernel panic or corruption of filesystem metadata and data. The issue also improperly clears a flag that marks a reloc tree as dead when it should not be, further compromising data integrity.

Any Linux kernel that includes the Btrfs filesystem code—for example, mainstream Linux distributions—may be affected by this defect.

The vulnerability is scored 7.8 on CVSS, indicating high severity, while the EPSS score is less than 1%, suggesting a low probability of exploitation. It is not listed in the CISA KEV catalog. The most likely attack vector is a local privileged user or process that can perform operations on a Btrfs volume (such as mounting or writing to it). A local attacker could potentially trigger the race condition to fault the kernel or corrupt data, but no public exploit is known, so timely patching is advised.