A race in sb_write_pointer allows concurrent block size changes while the superblock is being read from page cache. The unsynchronized read can return corrupted or incomplete data, which may lead to filesystem corruption or instability, potentially causing data loss or crash. This weakness is a thread‑safety failure and does not provide a traditional attack vector for code execution or privilege escalation.

All Linux kernel builds using Btrfs prior to the commit that serializes sb_write_pointer with the invalidate lock are affected. This includes any kernel version that has not applied the patch fixing the race with BLKBSZSET. The commit that introduced the protection (identified by the hash 123b9a5…) is available in the Linux kernel source tree and should be applied to any affected release.

The vulnerability has no publicly known exploit and is not listed in CISA’s KEV catalog; EPSS score is < 1%. Because the flaw requires concurrent modification of block size parameters and a kernel read of the superblock, an attacker would need low‑level access to the system, typically root or physical access. The CVSS score of 4.1 indicates medium severity, and the potential impact is medium to high if the race occurs, but the likelihood is limited to specific conditions. Updating to a kernel version containing the fix is the recommended mitigation.