When the btrfs filesystem attempts to update an inode during a hole‑punching operation or the creation of a reflink, a failure to write the inode is not handled properly; the transaction continues in progress instead of being aborted. As a result, extent items may be removed or inserted without corresponding inode updates, leading to a stale or corrupted in‑kernel metadata state that can be committed to disk, producing persistent file system inconsistencies.

All Linux distributions that compile the core Linux kernel with btrfs filesystem support and enable hole punching or reflink features are at risk. The vulnerability exists in the kernel's btrfs transaction logic and is not limited to a specific kernel release, so any compiled btrfs module that includes the affected code path remains vulnerable until patched.

The likely attack vector is local: an actor who can write to a btrfs volume and initiate a hole‑punch or reflink operation—such as by creating, truncating, or copying a file—can trigger the flaw. The EPSS score is indicated as < 1 %, suggesting that, while low, the potential for exploitation is non‑zero. The CVSS score is 5.5. The vulnerability is not tracked in CISA’s KEV catalog, and the impact on data integrity is severe and could cause irreversible corruption if the error occurs during a transaction that successfully commits.