A flaw in the Linux kernel’s Btrfs filesystem handling occurs when replacing an extended attribute (xattr) that resides in a packed btrfs_dir_item with a value of a different size. The code deletes the old item and inserts a new one, shifting the leaf data. The new item ends up in an uninitialized section, leaving critical fields such as name, key, flags, and transaction ID unset. This improper initialization results in corrupted metadata, loss of the replaced attribute, and transaction aborts that can lead to kernel panic or filesystem corruption. The weakness is a CWE-665: Improper Initialization, and the damage is confined to filesystem metadata rather than arbitrary code execution.

All Linux kernel distributions that compile the default Btrfs filesystem are potentially affected. The patch is required for any deployment that uses Btrfs and has not yet applied the fix, with no specific version range listed in the advisory; therefore it applies to all kernel releases that contain the unpatched code.

The likely attack vector is local modification of extended attributes on a Btrfs volume; this is inferred from the description that setxattr(2) calls trigger the flaw. An attacker with write access to a btrfs filesystem can replace an existing xattr with a larger value to trigger the corruption. The EPSS score is < 1%, indicating a low probability of exploitation, but the CVSS score of 9.8 signals a high severity impact. The vulnerability is not listed in CISA’s KEV catalog. Successful exploitation would cause data loss and possible kernel panic, but it does not provide arbitrary code execution or remote access.