A bug in the Linux kernel btrfs implementation causes a kernel warning and forces the filesystem to switch to read‑only when the quota feature is enabled and snapshot or balance operations are performed. The error exhibits that a tree reference points to a metadata extent that no longer exists, leading to invalid memory interactions and possible corruption of the btrfs metadata structures. As a result, normal file operations can fail, data may become inconsistent, and the entire filesystem can become unusable without manual repair.

All Linux kernel builds containing btrfs and the quota functionality are affected, regardless of distribution. The exact affected kernel versions are not listed, so any kernel prior to the fix that supports btrfs quotas can potentially experience the issue. Users who have created snapshots or run balance commands on a quota‑enabled btrfs device are at risk.

CVSS score of 5.5 indicates a moderate impact. The exploitability probability remains low (EPSS < 1%) and the vulnerability is not listed in CISA KEV. The fault arises from an out‑of‑bounds read, improper assertion, and improper resource release, as identified by CWE‑617 and CWE‑672. The likely attack vector is local; a user with write access to a btrfs filesystem with quotas enabled can trigger a snapshot or balance operation, causing the kernel to mark the filesystem as read‑only, leading to denial of service or data loss. While no remote code execution or privilege escalation is reported, improper handling of metadata can result in filesystem corruption or loss of data integrity.