The Linux kernel’s btrfs file system contains a flaw where tree‑checker fails to validate ROOT_REF and ROOT_BACKREF items before use. The items store a structure followed by a subvolume name, and several code paths unconditionally read the on‑disk name length. A maliciously corrupted item can cause these readers to reference bytes beyond the payload, and the BTRFS_IOC_GET_SUBVOL_INFO ioctl can copy more data into a fixed‑size user buffer than the item actually contains. This out‑of‑bounds read exposes kernel data and may trigger a crash, resulting in data loss or disclosure.

All Linux kernel builds that lack the recent commit adding validation for ROOT_REF and ROOT_BACKREF items are affected. Distribution kernels not yet updated for this fix remain vulnerable. The issue is confined to the btrfs file system, but it can be triggered from any user with permissions to use the ioctl interface.

There is no published CVSS score and EPSS data is unavailable, so the quantitative likelihood of exploitation is unknown. However, because the flaw permits arbitrary reads beyond a fixed buffer boundary, an adversary could potentially exfiltrate kernel memory or cause a denial of service. The vulnerability is not yet listed in the CISA KEV catalog, indicating that it has not been widely exploited but solving it remains prudent.