The vulnerability resides in the Linux kernel’s handling of BTRFS file system operations via io_uring. When an io_uring request returns –EAGAIN, the code fails to clear a persistent buffer called btrfs_uring_encoded_data that remains attached to the command PDU. Because the driver does not free these allocations on cleanup, a cancelled or prematurely terminated request can expose the stale data to the requesting process, leaking potentially sensitive kernel or file system information. This flaw is a classic resource‑leak weakness (CWE‑772).

All systems running a Linux kernel that includes BTRFS support with io_uring enabled are potentially impacted. The exploit is present in every kernel release that compiles the affected code paths until the documented patch that clears stale data on –EAGAIN is applied. No specific kernel version range is listed in the advisory, but any build containing the buggy paths is at risk.

Based on the description, it is inferred that the primary attack vector is local exploitation by a process that can issue io_uring requests to a BTRFS file system. The EPSS score of < 1 % indicates that real-world exploitation is unlikely, and the CVSS score of 3.3 reflects a low severity. The vulnerability is not listed in the CISA KEV catalog. An attacker would need sufficient privileges to target io_uring operations or abuse a privileged process to trigger repeated –EAGAIN cancellations, which could lead to information leakage or memory exhaustion. The attack is confined to scenarios where the kernel has not yet cleared orphaned buffers during a request failure.