This flaw in the Btrfs filesystem occurs when a RAID stripe extent allocation fails. The insert function aborts the transaction before returning, yet the caller still holds a reference to the transaction handle. Because the transaction cleanup frees the handle and then the caller aborts again, the code uses a transaction that has already been freed. This use‑after‑free can corrupt kernel memory, allowing an attacker to overwrite privileged structures or crash the system, which may lead to privilege escalation or denial of service.

The vulnerability is present in the Linux kernel’s Btrfs implementation. Any kernel built from the source tree that includes the legacy btrfs raid stripe insertion logic is potentially vulnerable. The issue is tied specifically to filesystems configured with Btrfs RAID, so non‑RAID configurations are not affected.

The flaw is a use‑after‑free within kernel space; the CVSS score is 7, indicating a high severity. Exploitation would require the attacker to trigger a stripe insertion failure, typically through manipulation of Btrfs structures or file operations. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widely known exploits yet. Nevertheless, because it can lead to kernel memory corruption and potentially privilege escalation or a system crash, the risk level is high. The likely attack vector is local, requiring privileged access to manipulate a Btrfs RAID file system.