The bug is a use‑after‑free in the Btrfs filesystem driver that occurs when creating the first metadata chunk for a sprout filesystem. If a subsequent system chunk creation fails, the code aborts the transaction and releases the device while it remains on the transaction update list, leaving the list pointing to freed memory. This condition can trigger a kernel memory corruption, which may allow an attacker with sufficient privileges to execute arbitrary code in kernel mode. The weakness is a classic use‑after‑free (CWE‑416).

All Linux kernel releases that include Btrfs support for sprout filesystems are affected. No specific version information is listed in the available data.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no documented public exploitation yet. The absence of a CVSS score means the objective severity is unclear, but the kernel‑level nature of the bug suggests that a successful exploit would likely be high impact. The attack vector is local and would require the attacker to influence sprout filesystem operations or have privileged access to trigger the failure path.