The vulnerability resides in the Linux kernel’s btrfs file system implementation. During execution of mark_block_group_to_copy() the code iterates over the commit root with skip_locking set to true, but it does not hold the commit root semaphore. A concurrent transaction commit can therefore swap and free the commit root while the iteration is still in progress, causing a use-after-free of extent buffers. The resulting memory corruption occurs in privileged kernel context and could be abused to modify kernel state.

All Linux kernel builds that ship the unpatched btrfs driver are affected. No specific release numbers are identified, so any distribution that includes the default btrfs implementation prior to the applied patch is at risk.

The flaw has a base CVSS score of 7.0 and an EPSS score of <1%, indicating a low predicted exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require an attacker to trigger a race condition via concurrent btrfs operations, generally necessitating local privileged access. No public exploits are known at this time.