An issue was discovered in the Linux kernel through 4.17.10. There is an
invalid pointer dereference in io_ctl_map_page() when mounting and
operating a crafted btrfs image, because of a lack of block group item
validation in check_leaf_item in fs/btrfs/tree-checker.c.

Wen Xu and Po-Ning Tseng discovered that btrfs file system implementation
in the Linux kernel did not properly validate metadata. An attacker could
use this to construct a malicious btrfs image that, when mounted, could
cause a denial of service (system crash).