In the Linux kernel, enabling btrfs verity can trigger a rollback when the qgroup limit or lack of space is reached. The rollback operation was incorrectly implemented, failing to reserve the needed metadata space. This flaw represents a resource exhaustion weakness and a failure to properly release critical resources (CWE-459). As a result, the rollback fails, rendering the entire filesystem read‑only and preventing orphan cleanups from succeeding on the next mount. The consequence is a denial of service where the filesystem cannot be mounted read‑write, and any subsequent attempt to mount read‑write will fail, leaving subvolumes unreachable or the entire system in a read‑only state.

The flaw resides in the kernel code that powers btrfs on Linux. All Linux distributions that ship a kernel version containing this code are affected, regardless of distribution metadata, until the patch that adds the global reserve calls for orphan cleanup, verity removal, and rollback is applied.

The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.5 indicates a moderate severity. The impact is a local denial of service that can arise when an attacker with root or equivalent privileges triggers a qgroup limit or a full‑filesystem condition during a verity operation. The attack requires kernel‑level interaction and is not exploitable over the network, but it presents a real threat whenever privileged access is available.