The flaw originates in the Linux kernel’s Btrfs URing read path, where btrfs_uring_read_extent_endio incorrectly returned a negative error code that caused btrfs_uring_read_extent() to unlock and free a kernel data structure concurrently with btrfs_uring_read_finished() performing the same action. This double unlock and free means the kernel data structure could be freed twice, potentially corrupting memory. This is a CWE‑1341 type vulnerability, i.e., an incorrect function return value. If the kernel crashes or becomes unstable as a result, the system would lose availability. That potential crash outcome is inferred from the double‑free description, as the CVE does not explicitly state a crash.

The affected component is the Linux kernel. Any kernel version that implements btrfs_uring_read_extent_endio before the patch that changes the return value to -EIOCBQUEUED is vulnerable. In practice, this means all currently supported Linux kernel releases prior to the commit that introduced the fix – commit identifiers include 033dda5b321f01661de518a8d5c8607ae8675b14, 80a8dbb30d2b00b9c671b02bd73f700f6d20100f, and a449433b0e3d4a3715d0bbee078f8c603f03c9f6 – are affected. No specific kernel version list is provided in the data, so administrators should determine whether their running kernel contains these commits.

The CVSS base score is 4.7, indicating moderate impact with a low to moderate exploitation potential. The EPSS score is less than 1%, suggesting a very low probability of real‑world exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to perform a URing read operation on a Btrfs filesystem, which typically requires local access with sufficient privileges to read the filesystem. The vulnerability is not remotely exploitable and is inferred to be a local privilege‑related vector. The risk remains that a native user could trigger the double‑free bug, potentially leading to kernel corruption and loss of availability, although the likelihood of successful exploitation is low.