An issue was discovered in the Linux kernel through 4.17.10. There is a use-after-free in trymergefreespace() when mounting a crafted btrfs image, because of a lack of chunk type flag checks in btrfscheckchunkvalid in fs/btrfs/volumes.c.
{ "urgency": "not yet assigned" }