The issue is triggered when the btrfs_uring_read_extent() function fails to release inode and extent locks due to an error handling bug. Because the locks remain held, other operations on the same resources block, potentially leading to deadlock or prolonged resource starvation, and resulting in a denial of service on the affected system. This flaw aligns with weakness identified by CWE-772.

Any Linux kernel that implements the btrfs filesystem with io_uring support may be vulnerable. The advisory does not specify exact kernel versions, so any build lacking the patch could be affected; common distribution kernels that have not yet applied the update may also be at risk.

With a CVSS score of 4.7 and an EPSS score of less than 1%, the severity is moderate and the exploitation probability in the wild is very low. The flaw requires a user or process to trigger a failing io_uring read on a btrfs volume, which would primarily cause denial of service for other local users. Based on the description, the attack vector is inferred to be local, as the bug can only be triggered by a local attacker issuing the failing I/O operation.