cbcvebase.
CVE-2022-50067
published 2025-06-18

CVE-2022-50067: In the Linux kernel, the following vulnerability has been resolved: btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() In…

PriorityP337high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.19%
8.7th percentile
In the Linux kernel, the following vulnerability has been resolved: btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() In btrfs_relocate_block_group(), the rc is allocated. Then btrfs_relocate_block_group() calls relocate_block_group() prepare_to_relocate() set_reloc_control() that assigns rc to the variable fs_info->reloc_ctl. When prepare_to_relocate() returns, it calls btrfs_commit_transaction() btrfs_start_dirty_block_groups() btrfs_alloc_path() kmem_cache_zalloc() which may fail for example (or other errors could happen). When the failure occurs, btrfs_relocate_block_group() detects the error and frees rc and doesn't set fs_info->reloc_ctl to NULL. After that, in btrfs_init_reloc_root(), rc is retrieved from fs_info->reloc_ctl and then used, which may cause a use-after-free bug. This possible bug can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag(). To fix this possible bug, in prepare_to_relocate(), check if btrfs_commit_transaction() fails. If the failure occurs, unset_reloc_control() is called to set fs_info->reloc_ctl to NULL. The error log in our fault-injection testing is shown as follows: [ 58.751070] BUG: KASAN: use-after-free in btrfs_init_reloc_root+0x7ca/0x920 [btrfs] ... [ 58.753577] Call Trace: ... [ 58.755800] kasan_report+0x45/0x60 [ 58.756066] btrfs_init_reloc_root+0x7ca/0x920 [btrfs] [ 58.757304] record_root_in_trans+0x792/0xa10 [btrfs] [ 58.757748] btrfs_record_root_in_trans+0x463/0x4f0 [btrfs] [ 58.758231] start_transaction+0x896/0x2950 [btrfs] [ 58.758661] btrfs_defrag_root+0x250/0xc00 [btrfs] [ 58.759083] btrfs_ioctl_defrag+0x467/0xa00 [btrfs] [ 58.759513] btrfs_ioctl+0x3c95/0x114e0 [btrfs] ... [ 58.768510] Allocated by task 23683: [ 58.768777] ____kasan_kmalloc+0xb5/0xf0 [ 58.769069] __kmalloc+0x227/0x3d0 [ 58.769325] alloc_reloc_control+0x10a/0x3d0 [btrfs] [ 58.769755] btrfs_relocate_block_group+0x7aa/0x1e20 [btrfs] [ 58.770228] btrfs_relocate_chunk+0xf1/0x760 [btrfs]

Affected

24 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.0.2-1 (bookworm)linux 6.0.2-1 (bookworm)
linuxlinux
linuxlinux>= 1a5353475df8fcaf200fecc9e961a3900d15e891 < ff0e8ed8dfb584575cffc1561f17a1d094e8565bff0e8ed8dfb584575cffc1561f17a1d094e8565b
linuxlinux>= 4223d91ca1b5bf3928e5722c3c6b3fdb49250ab3 < 8e546674031fc1576da501e27a8fd165222e5a378e546674031fc1576da501e27a8fd165222e5a37
linuxlinux>= 499d29bf151951399367ba83645abfdb429a3af9 < dcb11fe0a0a9cca2b7425191b9bf30dc29f2ad0fdcb11fe0a0a9cca2b7425191b9bf30dc29f2ad0f
linuxlinux>= 6f371623f315c26100e603c2e8837cdbe130f9e0 < b60e862e133f646f19023ece1d476d630a660de1b60e862e133f646f19023ece1d476d630a660de1
linuxlinux>= fb686c6824dd6294ca772b92424b8fba666e7d00 < 78f8c2370e3d33e35f23bdc648653d779aeacb6e78f8c2370e3d33e35f23bdc648653d779aeacb6e
linuxlinux>= fb686c6824dd6294ca772b92424b8fba666e7d00 < 5d741afed0bac206640cc64d77b97853283cf7195d741afed0bac206640cc64d77b97853283cf719
linuxlinux>= fb686c6824dd6294ca772b92424b8fba666e7d00 < 85f02d6c856b9f3a0acf5219de6e32f58b9778eb85f02d6c856b9f3a0acf5219de6e32f58b9778eb
linuxlinux_kernel< 4.14.3184.14.318
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.191-15.10.191-1
linuxlinux_kernel>= 0 < 6.0.2-16.0.2-1
linuxlinux_kernel>= 0 < 6.0.2-16.0.2-1
linuxlinux_kernel>= 0 < 6.0.2-16.0.2-1
linuxlinux_kernel>= 0 < 5.15.0-164.1745.15.0-164.174
linuxlinux_kernel>= 0 < 4.4.0-276.3104.4.0-276.310
linuxlinux_kernel>= 0 < 4.15.0-245.2574.15.0-245.257
linuxlinux_kernel>= 0 < 5.4.0-224.2445.4.0-224.244
linuxlinux_kernel>= 4.15 < 4.19.2864.19.286
linuxlinux_kernel>= 4.20 < 5.4.2475.4.247
linuxlinux_kernel>= 5.11 < 5.15.635.15.63
linuxlinux_kernel>= 5.16 < 5.19.45.19.4
linuxlinux_kernel>= 5.5 < 5.10.1845.10.184

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.