This flaw in the Btrfs filesystem occurs when a RAID stripe extent allocation fails. The insert function aborts the transaction before returning, yet the caller still holds a reference to the transaction handle. Because the transaction cleanup frees the handle and then the caller aborts again, the code uses a transaction that has already been freed. This use‑after‑free can corrupt kernel memory, allowing an attacker to overwrite privileged structures or crash the system, which may lead to privilege escalation or denial of service.

The vulnerability is present in the Linux kernel’s Btrfs implementation. Any kernel built from the source tree that includes the legacy btrfs raid stripe insertion logic is potentially vulnerable. The issue is tied specifically to filesystems configured with Btrfs RAID, so non‑RAID configurations are not affected.

The flaw is a use‑after‑free within kernel space; exploitation would require the attacker to trigger a stripe insertion failure, typically through manipulation of Btrfs structures or file operations. The public CVSS score is not provided and EPSS data is unavailable, indicating that the exploitation probability is uncertain. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widely known exploits yet. Nevertheless, because it can lead to kernel memory corruption and potentially privilege escalation or crash, the risk level is high. The attack vector is inferred to be local, requiring access to a privileged user manipulating a Btrfs RAID file system.