The vulnerability resides in the Linux kernel’s btrfs implementation. During a subvolume relocation, an error in insert_dirty_subvol() can cause the reloc_root field of a root to reference a freed memory object. When the file system is later unmounted, this dangling pointer is dereferenced, resulting in a use‑after‑free or double‑free that leads to a kernel crash. Because the fault occurs in kernel space, it could also provide a foothold for an attacker to execute arbitrary code with elevated privileges.

All Linux kernel builds that contain the vulnerable btrfs subvolume relocation logic are affected; the specific versions are not enumerated in the advisory, but any kernel that incorporates the identified commit (e.g., 83201804efa4a5168be754e1dfc9b2faee760cac) or earlier is susceptible. The vendor is the Linux kernel project.

The CVE is not listed in the CISA KEV catalog and its EPSS score is < 1%, indicating no publicly known exploitation. Its CVSS score is 7.0, classifying it as high severity. The likely attack vector is inferred to be the intentional or accidental triggering of a failing relocation transaction—such as inducing disk I/O errors or performing subvolume operations that provoke the error path. If successful, this could cause a kernel crash or privilege escalation; given the kernel context, the risk is considered high even without documented exploits.