Linux Kernel EUVD-2026-57050

Exploitation requires all of the following: (1) local, authenticated access with low-privilege credentials (CVSS PR:L) - remote exploitation is not possible per AV:L; (2) the target filesystem must be btrfs - systems using ext4, xfs, tmpfs, or any non-btrfs filesystem are completely unaffected regardless of kernel version; (3) the vulnerable code path requires an inode to have an extent map bearing EXTENT_FLAG_LOGGING at the moment btrfs_drop_extent_map_range() splits it, which occurs during active logging (e.g., fsync or transaction commit on a recently written file); (4) the kernel's extent map shrinker must reclaim the split map while it still resides on the inode's modified_extents list, introducing a timing dependency that may require memory pressure or repeated attempts to trigger reliably. Factors limiting exploitation: no network vector, requires valid local shell, btrfs must be actively mounted and in use, and the race window between logging and shrinker reclaim introduces non-trivial AC.

The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures the core risk profile: local access with low privileges can trigger a kernel use-after-free, with full confidentiality, integrity, and availability impact on the compromised host. The 16% EPSS score is notably elevated for a kernel filesystem bug - typical for local privilege escalation classes once the code path is well understood - meaning even a mid-sized municipal IT team in olsztyn should treat this as urgent if btrfs is in their storage stack. The lack of a CISA KEV listing means active exploitation is not confirmed, and no public POC or exploit code has been identified, which partially offsets the high CVSS score in immediate triage. The AC:L rating in the provided vector may be slightly optimistic: the use-after-free requires the extent map shrinker to race with an active logging operation on the same inode, suggesting some timing dependency that could warrant AC:H in practice - defenders should verify behavior under memory pressure conditions. The scope is bounded to systems actively using btrfs; hosts using ext4, xfs, or other filesystems are entirely unaffected, which meaningfully limits the real-world attack surface despite the kernel's ubiquity.

A local user with a standard shell account on a Linux server using btrfs mounts - common in environments using btrfs for snapshotting or CoW features - performs file operations designed to trigger extent map splitting during an active btrfs logging cycle, such as concurrent writes and fsync operations on the same inode. Under memory pressure, the kernel's extent map shrinker frees a split map still flagged with EXTENT_FLAG_LOGGING and still linked on the modified_extents list, triggering a use-after-free that can be exploited to overwrite kernel memory structures and escalate privileges to root.