CVE-2022-50456
published 2025-10-01CVE-2022-50456: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix resolving backrefs for inline extent followed by prealloc If a file consists of…
PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.15%
4.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix resolving backrefs for inline extent followed by prealloc
If a file consists of an inline extent followed by a regular or prealloc
extent, then a legitimate attempt to resolve a logical address in the
non-inline region will result in add_all_parents reading the invalid
offset field of the inline extent. If the inline extent item is placed
in the leaf eb s.t. it is the first item, attempting to access the
offset field will not only be meaningless, it will go past the end of
the eb and cause this panic:
[17.626048] BTRFS warning (device dm-2): bad eb member end: ptr 0x3fd4 start 30834688 member offset 16377 size 8
[17.631693] general protection fault, probably for non-canonical address 0x5088000000000: 0000 [#1] SMP PTI
[17.635041] CPU: 2 PID: 1267 Comm: btrfs Not tainted 5.12.0-07246-g75175d5adc74-dirty #199
[17.637969] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[17.641995] RIP: 0010:btrfs_get_64+0xe7/0x110
[17.649890] RSP: 0018:ffffc90001f73a08 EFLAGS: 00010202
[17.651652] RAX: 0000000000000001 RBX: ffff88810c42d000 RCX: 0000000000000000
[17.653921] RDX: 0005088000000000 RSI: ffffc90001f73a0f RDI: 0000000000000001
[17.656174] RBP: 0000000000000ff9 R08: 0000000000000007 R09: c0000000fffeffff
[17.658441] R10: ffffc90001f73790 R11: ffffc90001f73788 R12: ffff888106afe918
[17.661070] R13: 0000000000003fd4 R14: 0000000000003f6f R15: cdcdcdcdcdcdcdcd
[17.663617] FS: 00007f64e7627d80(0000) GS:ffff888237c80000(0000) knlGS:0000000000000000
[17.666525] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[17.668664] CR2: 000055d4a39152e8 CR3: 000000010c596002 CR4: 0000000000770ee0
[17.671253] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[17.673634] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[17.676034] PKRU: 55555554
[17.677004] Call Trace:
[17.677877] add_all_parents+0x276/0x480
[17.6
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.4-1 (bookworm) | linux 6.1.4-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 8da6d5815c592b713ecaf4f4f8b631f8359c96c4 < c59ee1528b3432ec9dca220567f7eb507820917a | c59ee1528b3432ec9dca220567f7eb507820917a |
| linux | linux | >= 8da6d5815c592b713ecaf4f4f8b631f8359c96c4 < 0061ab5153fb8bc574b44fbb773680d0ede48c9c | 0061ab5153fb8bc574b44fbb773680d0ede48c9c |
| linux | linux | >= 8da6d5815c592b713ecaf4f4f8b631f8359c96c4 < 99590f29b2b7567fda2b503aa3d81a0d3e09dce5 | 99590f29b2b7567fda2b503aa3d81a0d3e09dce5 |
| linux | linux | >= 8da6d5815c592b713ecaf4f4f8b631f8359c96c4 < 645e2dac6e97f756f28a2f82b2e7bf7f29a68827 | 645e2dac6e97f756f28a2f82b2e7bf7f29a68827 |
| linux | linux | >= 8da6d5815c592b713ecaf4f4f8b631f8359c96c4 < a94b90ac1f251d1007c0c43ee289a61b50f2505f | a94b90ac1f251d1007c0c43ee289a61b50f2505f |
| linux | linux | >= 8da6d5815c592b713ecaf4f4f8b631f8359c96c4 < 560840afc3e63bbe5d9c5ef6b2ecf8f3589adff6 | 560840afc3e63bbe5d9c5ef6b2ecf8f3589adff6 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 3.3 < 5.4.229 | 5.4.229 |
| linux | linux_kernel | >= 5.11 < 5.15.87 | 5.15.87 |
| linux | linux_kernel | >= 5.16 < 6.0.18 | 6.0.18 |
| linux | linux_kernel | >= 5.5 < 5.10.163 | 5.10.163 |
| linux | linux_kernel | >= 6.1 < 6.1.4 | 6.1.4 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2022-50456: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix resolving backrefs for inline extent followed by prealloc If a file con
osv·2025-10-01·CVSS 5.5
CVE-2022-50456 [MEDIUM] CVE-2022-50456: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix resolving backrefs for inline extent followed by prealloc If a file con
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix resolving backrefs for inline extent followed by prealloc If a file consists of an inline extent followed by a regular or prealloc extent, then a legitimate attempt to resolve a logical address in the non-inline region will result in add_all_parents reading the invalid offset field of the inline extent. If the inline extent item is placed in the leaf eb s.t. it is the first item, attempting to access the offset field will not only be meaningless, it will go past the end of the eb and cause this panic: [17.626048] BTRFS warning (device dm-2): bad eb member end: ptr 0x3fd4 start 30834688 member offset 16377 size 8 [17.631693] general protection fault, probably for non-canonical address 0x5088000000000: 0000 [#1] S
GHSA
GHSA-3r5q-xgpg-g928: In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix resolving backrefs for inline extent followed by prealloc
If a file c
ghsa_unreviewed·2025-10-01
CVE-2022-50456 [MEDIUM] GHSA-3r5q-xgpg-g928: In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix resolving backrefs for inline extent followed by prealloc
If a file c
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix resolving backrefs for inline extent followed by prealloc
If a file consists of an inline extent followed by a regular or prealloc
extent, then a legitimate attempt to resolve a logical address in the
non-inline region will result in add_all_parents reading the invalid
offset field of the inline extent. If the inline extent item is placed
in the leaf eb s.t. it is the first item, attempting to access the
offset field will not only be meaningless, it will go past the end of
the eb and cause this panic:
[17.626048] BTRFS warning (device dm-2): bad eb member end: ptr 0x3fd4 start 30834688 member offset 16377 size 8
[17.631693] general protection fault, probably for non-canonical address 0x5088000000000: 0000 [#1
Red Hat
kernel: btrfs: fix resolving backrefs for inline extent followed by prealloc
vendor_redhat·2025-10-01·CVSS 5.5
CVE-2022-50456 [MEDIUM] CWE-823 kernel: btrfs: fix resolving backrefs for inline extent followed by prealloc
kernel: btrfs: fix resolving backrefs for inline extent followed by prealloc
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix resolving backrefs for inline extent followed by prealloc
If a file consists of an inline extent followed by a regular or prealloc
extent, then a legitimate attempt to resolve a logical address in the
non-inline region will result in add_all_parents reading the invalid
offset field of the inline extent. If the inline extent item is placed
in the leaf eb s.t. it is the first item, attempting to access the
offset field will not only be meaningless, it will go past the end of
the eb and cause this panic:
[17.626048] BTRFS warning (device dm-2): bad eb member end: ptr 0x3fd4 start 30834688 member offset 16377 size 8
[17.631693] general pro
Debian
CVE-2022-50456: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: fix ...
vendor_debian·2022·CVSS 5.5
CVE-2022-50456 [MEDIUM] CVE-2022-50456: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: fix ...
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix resolving backrefs for inline extent followed by prealloc If a file consists of an inline extent followed by a regular or prealloc extent, then a legitimate attempt to resolve a logical address in the non-inline region will result in add_all_parents reading the invalid offset field of the inline extent. If the inline extent item is placed in the leaf eb s.t. it is the first item, attempting to access the offset field will not only be meaningless, it will go past the end of the eb and cause this panic: [17.626048] BTRFS warning (device dm-2): bad eb member end: ptr 0x3fd4 start 30834688 member offset 16377 size 8 [17.631693] general protection fault, probably for non-canonical address 0x5088000000000: 0000 [#1] S
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/0061ab5153fb8bc574b44fbb773680d0ede48c9chttps://git.kernel.org/stable/c/560840afc3e63bbe5d9c5ef6b2ecf8f3589adff6https://git.kernel.org/stable/c/645e2dac6e97f756f28a2f82b2e7bf7f29a68827https://git.kernel.org/stable/c/99590f29b2b7567fda2b503aa3d81a0d3e09dce5https://git.kernel.org/stable/c/a94b90ac1f251d1007c0c43ee289a61b50f2505fhttps://git.kernel.org/stable/c/c59ee1528b3432ec9dca220567f7eb507820917a
2025-10-01
Published