Linux Kernel EUVD-2026-86913

Requires a locally mounted btrfs filesystem that uses the raid-stripe-tree feature (introduced in Linux 6.7, opt-in and not a default), plus the ability to drive the kernel into a memory-allocation failure (-ENOMEM) precisely during btrfs_insert_one_raid_extent() within ordered-extent finishing. Limiting factors: exploitation is not attacker-input-controlled - it hinges on hitting an OOM condition at the exact failure site (hence AC:H), needs local access with the privilege to perform filesystem writes that trigger stripe insertion (PR:L), and only affects kernels 6.7 through the fixed stable releases (6.12.111/6.18.53/7.2.7/7.3-rc2). Systems not using raid-stripe-tree are unaffected.

This is a classic high-CVSS-but-low-real-risk kernel issue. The NVD CVSS of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) is inflated on the impact side: the described defect is a transaction handle use-after-free reached ONLY when a RAID stripe extent allocation fails with -ENOMEM, causing btrfs_finish_one_ordered() and its callee to each end the transaction. The realistic outcome is memory corruption and a kernel crash (DoS), not the full confidentiality/integrity/availability compromise the C:H/I:H claims imply - there is no evidence of an attacker-controllable read/write primitive or information disclosure. No EPSS score, no CISA KEV listing, and no public POC are present in the input, and the trigger is an allocation-failure error path rather than an attacker-supplied input, which is why AC:H (hard to reliably reach) is appropriate. PR:L and AV:L are consistent: the actor needs local access to a filesystem using the raid-stripe-tree feature and must drive the kernel into an OOM condition at the exact site. Net: not a patching priority relative to remotely reachable flaws; treat as routine stable-kernel hygiene. Note the Tags field mislabels this as 'Information Disclosure' - the description is a use-after-free/DoS with no disclosure element.

A local user on a system whose btrfs filesystem uses the raid-stripe-tree feature drives the kernel into memory pressure so that a RAID stripe extent allocation returns -ENOMEM during ordered-extent finishing; the doubled transaction-end then frees the transaction while the caller still references it, triggering a use-after-free and likely kernel panic. Reliable triggering is difficult because it depends on hitting an allocation failure at a precise code path, consistent with AC:H. No public exploit code is identified at time of analysis.