The vulnerability (CVE-2026-64593) involves the Btrfs filesystem in the Linux kernel where the function btrfs_trim_fs() may attempt to trim a device that is not writable, resulting in a NULL pointer dereference. This happens because the device's bdev pointer remains NULL after the device re-appears and the BTRFS_DEV_STATE_MISSING flag is cleared, but the BTRFS_DEV_STATE_WRITEABLE flag is not set. The kernel then crashes when btrfs_trim_free_extents_throttle() calls bdev_max_discard_sectors() on a NULL pointer. The root cause is a desynchronization between the device state flags and the device pointer during device re-scanning. A fix has been implemented to address this gap in handling re-appearing devices.

This vulnerability can cause a kernel NULL pointer dereference leading to a system crash (kernel panic) when the Btrfs filesystem attempts to trim a device that is not writable. This results in denial of service due to the kernel crash. There is no indication of privilege escalation or data corruption beyond the crash.

A fix for this vulnerability has been implemented in the Linux kernel. Users should update to the fixed kernel version once available. Since this is a kernel-level issue, applying the official kernel patch or upgrading to a kernel version that includes the fix is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel mailing lists for the exact fixed version and update accordingly.