The Linux kernel's btrfs_encode_fh() function did not correctly account for all cases of file handle sizes it manages. Specifically, when a parent exists and the root ID of the parent and inode differ, the function writes a larger file handle size (40 bytes) than it originally reports (32 bytes). If the provided buffer length (*max_len) is insufficient, this leads to an 8-byte out-of-bounds write at fid->parent_root_objectid, causing potential memory corruption. A prior fix attempt was lost, but this issue has now been resolved by ensuring the function returns the correct size for all cases and validates buffer length before writing.

This vulnerability can cause memory corruption due to an out-of-bounds write in the kernel's btrfs filesystem code. The CVSS 3.1 vector rates it as high severity with local attack vector, low complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Although exploitation is not considered easily triggerable, successful exploitation could compromise system stability and security.

A patch resolving this issue is available and should be applied to affected Linux kernel versions. The fix ensures correct file handle size reporting and validates buffer length before writing, preventing out-of-bounds writes. Since this is a kernel vulnerability, updating the kernel to a patched version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; therefore, check the official Linux kernel advisories or vendor updates for the current remediation guidance.