A NULL pointer dereference occurs in the BTRFS balance routine when metadata corruption leaves a chunk entry without a matching block group in memory. The lookup function returns NULL, and the code proceeds to use the pointer, causing a kernel crash. The crash results in a kernel panic that brings the entire system down, effectively delivering a denial‑of‑service condition.

All Linux kernel releases that include the BTRFS file‑system implementation prior to the commit that added the NULL‑check. The advisory does not list a specific kernel version range, so any kernel that has not been updated to the patch commit 18d32b0013efba19f7add7aee813d604a6 is potentially affected. The affected product is the Linux kernel; vendor is Linux.

The EPSS score is not available and the vulnerability is not listed in CISA KEV, indicating no publicly known exploits to date. The most likely attack vector is a local attacker who can introduce or exploit metadata corruption and then run 'btrfs balance' on the affected file system. Because the crash occurs inside the privileged kernel, the impact is severe and can be leveraged for privilege escalation if the attacker can execute code in kernel space. The flaw is easy to trigger once corruption exists, making exploitation practical in an insider or compromised environment.