CVE-2022-50300
published 2025-09-15CVE-2022-50300: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map use-after-free when handling missing device in read_one_chunk Store…
PriorityP341high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.15%
4.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix extent map use-after-free when handling missing device in read_one_chunk
Store the error code before freeing the extent_map. Though it's
reference counted structure, in that function it's the first and last
allocation so this would lead to a potential use-after-free.
The error can happen eg. when chunk is stored on a missing device and
the degraded mount option is missing.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216721
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.4-1 (bookworm) | linux 6.1.4-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= adfb69af7d8cb6a3958f75aad1ef4bc96891d116 < b8e7ed42bc3ca0d0e4191ee394d34962d3624c22 | b8e7ed42bc3ca0d0e4191ee394d34962d3624c22 |
| linux | linux | >= adfb69af7d8cb6a3958f75aad1ef4bc96891d116 < fce3713197ebba239e1c7e02174ed216ea1ee014 | fce3713197ebba239e1c7e02174ed216ea1ee014 |
| linux | linux | >= adfb69af7d8cb6a3958f75aad1ef4bc96891d116 < 169a4cf46882974d4db6d85eb623ec898e51bbc0 | 169a4cf46882974d4db6d85eb623ec898e51bbc0 |
| linux | linux | >= adfb69af7d8cb6a3958f75aad1ef4bc96891d116 < 1742e1c90c3da344f3bb9b1f1309b3f47482756a | 1742e1c90c3da344f3bb9b1f1309b3f47482756a |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 4.15 < 5.15.87 | 5.15.87 |
| linux | linux_kernel | >= 5.16 < 6.0.18 | 6.0.18 |
| linux | linux_kernel | >= 6.1 < 6.1.4 | 6.1.4 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: Linux kernel: Denial of Service in btrfs due to use-after-free vulnerability
vendor_redhat·2025-09-15·CVSS 7.8
CVE-2022-50300 [HIGH] CWE-911 kernel: Linux kernel: Denial of Service in btrfs due to use-after-free vulnerability
kernel: Linux kernel: Denial of Service in btrfs due to use-after-free vulnerability
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix extent map use-after-free when handling missing device in read_one_chunk
Store the error code before freeing the extent_map. Though it's
reference counted structure, in that function it's the first and last
allocation so this would lead to a potential use-after-free.
The error can happen eg. when chunk is stored on a missing device and
the degraded mount option is missing.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216721
A flaw was found in the Linux kernel's btrfs filesystem component. A local user could exploit this use-after-free vulnerability by mounting a btrfs filesystem where a chunk is stored on a missing d
Debian
CVE-2022-50300: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: fix ...
vendor_debian·2022·CVSS 7.8
CVE-2022-50300 [HIGH] CVE-2022-50300: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: fix ...
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map use-after-free when handling missing device in read_one_chunk Store the error code before freeing the extent_map. Though it's reference counted structure, in that function it's the first and last allocation so this would lead to a potential use-after-free. The error can happen eg. when chunk is stored on a missing device and the degraded mount option is missing. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216721
Scope: local
bookworm: resolved (fixed in 6.1.4-1)
bullseye: open
forky: resolved (fixed in 6.1.4-1)
sid: resolved (fixed in 6.1.4-1)
trixie: resolved (fixed in 6.1.4-1)
OSV
CVE-2022-50300: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map use-after-free when handling missing device in read_one_chun
osv·2025-09-15·CVSS 7.8
CVE-2022-50300 [HIGH] CVE-2022-50300: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map use-after-free when handling missing device in read_one_chun
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map use-after-free when handling missing device in read_one_chunk Store the error code before freeing the extent_map. Though it's reference counted structure, in that function it's the first and last allocation so this would lead to a potential use-after-free. The error can happen eg. when chunk is stored on a missing device and the degraded mount option is missing. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216721
GHSA
GHSA-w775-9978-cp8r: In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix extent map use-after-free when handling missing device in read_one_chu
ghsa_unreviewed·2025-09-15
CVE-2022-50300 [HIGH] CWE-416 GHSA-w775-9978-cp8r: In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix extent map use-after-free when handling missing device in read_one_chu
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix extent map use-after-free when handling missing device in read_one_chunk
Store the error code before freeing the extent_map. Though it's
reference counted structure, in that function it's the first and last
allocation so this would lead to a potential use-after-free.
The error can happen eg. when chunk is stored on a missing device and
the degraded mount option is missing.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216721
No detection rules found.
No public exploits indexed.
2025-09-15
Published