The Linux kernel contains a flaw in the btrfs_uring_read_extent() function where a failure path skips freeing an iov data structure. This oversight leads to a kernel memory leak; repeated failures can exhaust available memory and cause the system to stall, effectively delivering a denial‑of‑service condition. The weakness is categorized as improper memory deallocation (CWE‑772).

All Linux kernel releases that ship a vanilla or patched btrfs runtime before the inclusion of commit 578ef517142420cf9d36b364ad4b3490b85469fb. This includes every distribution that contains the buggy btrfs implementation and exposes the uring interface.

The CVSS score of 3.3 marks the issue as low severity, and the EPSS score of < 1% indicates a very low probability of exploitation. The flaw is present in kernel space, and the likely attack vector requires an attacker to trigger btrfs_uring_read_extent() failures—most plausibly via local or privileged access that can invoke uring read operations on a btrfs filesystem. No publicly available exploits were reported at the time of publication. Although the risk is low, the potential for memory exhaustion warrants prompt remediation.