Linux Kernel EUVD-2026-86920

Exploitation requires a btrfs seed filesystem and a privileged, local attempt to add a new ('sprout') device via btrfs_init_new_device, during which the first writable-chunk creation or the subsequent sprout setup must FAIL - only on that specific error path are the latest_dev/s_bdev pointers left pointing at the freed sprout device, after which a read of btrfs_show_devname triggers the use-after-free crash. Limiting factors that reduce realistic risk: local access only (AV:L, no remote vector), the privileges needed to perform btrfs device management (the input states PR:L, though device-add typically needs administrative capability), the niche seed/sprout feature being in use, and the dependency on a failure condition rather than a reliably attacker-driven trigger. Impact is confined to availability (kernel DoS); there is no confidentiality or integrity effect.

This is a genuine but low-priority memory-safety defect, not a widespread exploitation threat. All signals agree on modest real-world risk: the CVSS 3.1 base score is 5.5 (MEDIUM) with a local attack vector (AV:L), low complexity (AC:L), and required privileges (PR:L), and the impact is confined to availability (C:N/I:N/A:H) - consistent with a CWE-416 use-after-free that crashes the kernel rather than leaking or corrupting data. EPSS reinforces this: 0.17% probability at the 5th percentile indicates exploitation is very unlikely to be seen broadly. There is no CISA KEV listing and no public exploit reference in the input, so this is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month' (routine patching), which is coherent with the other signals - none point to urgency. One point worth verifying: the input assigns PR:L, but triggering the vulnerable path requires performing a btrfs device-add on a seed filesystem, an operation that normally requires administrative capability; the honest privilege level may be higher than PR:L, which would further lower practical risk. No signals conflict here - CVSS, EPSS, absence of KEV/POC, and the 'this_month' label all converge on a low-urgency, patch-in-normal-cycle item.

A local user with the ability to perform btrfs device management operations adds a new device (a 'sprout') to a btrfs seed filesystem, and the chunk-creation or sprout-setup step fails. Because the error path releases the new device without restoring the latest_dev/s_bdev pointers switched away from the seed device, a subsequent read of device information via btrfs_show_devname dereferences the freed structure and crashes the kernel. No public exploit code is referenced; local access and the specific failure condition are required.