Linux Kernel EUVD-2025-201642

Exploitation requires local access with low privileges (PR:L) and a btrfs filesystem that has entered an error/abort state (e.g., via injected I/O errors or extent/free-space tree corruption) with unflushed dirty metadata still in the btree inode page cache. The RAID56 metadata profile is the specific configuration that reliably triggers the crash, because it invokes the read-modify-write path that queues work onto the already-stopped rmw_workers during close_ctree(); non-RAID56 configurations are far less likely to hit the use-after-free. Limiting factors: no remote or network vector (AV:L), no unauthenticated path (PR:L), and dependence on both a non-default RAID56 metadata layout and a prior filesystem error condition, all of which narrow real-world exploitability well below the raw 7.8 score.

The signals are internally consistent and point to a real but low-to-moderate real-world priority. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) confirms local access with low privileges and no user interaction, and the practical impact is a kernel crash/use-after-free (denial of service, matching the 'Denial Of Service' tag) with theoretical memory-corruption potential rather than a straightforward remote exploit. EPSS is very low at 0.03% (7th percentile), it is not on the CISA KEV list, and no POC is referenced, so there is no evidence of active or imminent widespread exploitation. Importantly, triggering requires the filesystem to already be in an error/abort state AND (most reliably) RAID56 btrfs metadata - a non-default, relatively uncommon configuration - which materially limits realistic exposure. This is best treated as a stability/robustness fix to roll out through normal patch cycles rather than an emergency.

A local user with low privileges runs a workload that induces btrfs I/O errors or a transaction abort on a filesystem using RAID56 metadata (similar to the fstests generic/388 pattern), then unmounts it. During unmount, dirty metadata is written back after the worker queues are freed, dereferencing the destroyed rmw_workers queue and triggering a use-after-free that crashes or destabilizes the kernel. No public exploit is identified at time of analysis, and the local, low-complexity vector means the primary realistic outcome is denial of service.