The Linux kernel’s btrfs file system can set a flag, BTRFS_FS_CREATING_FREE_SPACE_TREE, to indicate that a free space tree rebuild is underway. Several error paths return without clearing this flag, which causes delayed reference processing to be bypassed and leaves the free space tree in an untrusted state while normal file data remains accessible. This improper recovery can result in corruption or loss of filesystem metadata, effectively weakening data integrity. The issue is classified as CWE‑459 (Missing Release or Reset of Resources) and is a form of improper handling of kernel state rather than a direct code‑execution flaw.

Any system running a Linux kernel that includes the btrfs file system and has not yet incorporated the commit that clears BTRFS_FS_CREATING_FREE_SPACE_TREE is affected. The vulnerability applies to all kernel releases that ship with the btrfs tree before the patch identified by the commits in the supplied references (e.g., 3565893cc72cdf6b795cf6a33e7ff9605322334d, a32bedab8ece9d1f90a1476a5b486a1804dc78ba, and b1df2997d0cd2be7bef7b4ab64ccfd1019dedc81). Systems running newer kernels that include these commits are not vulnerable.

The CVSS score of 5.5 indicates medium severity, and the EPSS score of <1% reflects a low yet nonzero likelihood of exploitation at this time. Based on the description, it is inferred that an attacker must have local write access to a mounted btrfs file system and must trigger an error path during a free space tree rebuild to exploit the unwound flag. The vulnerability does not grant arbitrary code execution but can lead to metadata corruption and potential data loss, especially in production environments with write‑heavy workloads. The vulnerability is not listed in the CISA KEV catalog, which further suggests limited active exploitation.