A NULL pointer dereference occurs in the BTRFS balance routine when metadata corruption leaves a chunk entry without a corresponding block group in the in‑memory cache. The lookup function returns NULL, yet the code dereferences the pointer, causing a kernel panic that brings the entire system offline. The crash is a direct result of the NULL dereference in btrfs_may_alloc_data_chunk, leading to a denial of service on the affected machine.

All Linux kernel releases that include the BTRFS file‑system implementation before the patch commit 18d32b0013efba19f7ad3e5b08d7aee813d604a6 are potentially affected. This includes the Linux kernel itself, with the vendor identified as Linux. The advisory does not specify a precise kernel version range, so any kernel that has not incorporated the patch is at risk.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of < 1% suggests low likelihood of current exploitation. The vulnerability is not listed in CISA KEV, meaning no publicly known exploits are documented. Based on the description, it is inferred that a local attacker who can create or exploit metadata corruption and subsequently execute the btrfs balance operation could trigger the crash. The exploitation requires local access to the affected system and the ability to corrupt BTRFS metadata. Because the failure occurs within privileged kernel context, the impact is significant, potentially leading to denial of service.