The vulnerability creates a memory leak in BTRFS when an error occurs during raid extent insertion or when an ordered extent encounters an I/O error. Unreleased entries in the bioc_list accumulate, draining kernel memory over time and causing system instability or failure. This classic memory‑leak weakness can lead to a denial of service by exhausting available memory and disrupting normal kernel operation.

All Linux systems that employ a kernel containing the BTRFS filesystem and that include the unpatched btrfs_insert_one_raid_extent or related ordered extent implementation are vulnerable. Version information is not explicitly provided in the advisory; the flaw existed in all releases prior to the application of the btrfs_cleanup_ordered_bioc_list patch.

The CVSS score of 5.5 indicates a moderate severity. The EPSS score of less than 1% and the absence from the CISA KEV catalog imply that exploitation is unlikely at present, but it is not impossible. The memory‑leak path is confined to kernel space and will gradually consume kernel memory until a reboot or kernel panic occurs, potentially resulting in a denial of service. While the description does not explicitly state the required privileges, it is inferred that an attacker would need to induce an error condition in BTRFS operations—most likely a local user interacting with the filesystem or a privileged process that can influence BTRFS I/O. This inference is based on the fact that the leak is triggered by BTRFS insert or I/O error paths, which normally require local execution rights.