The vulnerability in btrfs causes the kernel to crash when it parses an INODE_REF item with an excessively large name length. A crafted image sets the namelen field to 4096 while the destination buffer is only 255 bytes wide, leading to an out‑of‑bounds memory copy inside memcpy. The result is a kernel panic that forces the system to reboot, effectively denying service.

Any Linux kernel that includes btrfs support and has not been updated to the patch that adds namelen verification is affected. The bug was demonstrated on a 7.1.0‑rc4‑custom kernel, but it applies to all releases prior to the commit that implements the check.

The CVSS score is not available and EPSS is not reported, so the exploitation probability is uncertain. The flaw can be triggered locally by mounting a malicious btrfs image, causing a kernel panic. It is not listed in the CISA KEV catalog, indicating no publicly known widespread exploitation. The attack requires the victim to mount the corrupted filesystem, so the impact is limited to environments that rely on btrfs for storage.