CVE-2022-49168: btrfs: do not clean up repair bio if submit fails
First published: Wed Feb 26 2025(Updated: )
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not clean up repair bio if submit fails The submit helper will always run bio_endio() on the bio if it fails to submit, so cleaning up the bio just leads to a variety of use-after-free and NULL pointer dereference bugs because we race with the endio function that is cleaning up the bio. Instead just return BLK_STS_OK as the repair function has to continue to process the rest of the pages, and the endio for the repair bio will do the appropriate cleanup for the page that it was given.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | ||
| Linux Kernel | <5.16.19 | |
| Linux Kernel | >=5.17<5.17.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-49168?
CVE-2022-49168 has a severity rating that can lead to potential use-after-free and NULL pointer dereference vulnerabilities in the Linux kernel.
How do I fix CVE-2022-49168?
To fix CVE-2022-49168, update your Linux kernel to version 5.17 or later.
What are the affected versions in CVE-2022-49168?
CVE-2022-49168 affects Linux kernel versions prior to 5.17 and versions between 5.16.19 and 5.17.2.
What is the impact of CVE-2022-49168?
The impact of CVE-2022-49168 could lead to system instability and potential exploitation by malicious actors.
Is CVE-2022-49168 related to file systems in Linux?
Yes, CVE-2022-49168 specifically relates to the Btrfs file system implementation in the Linux kernel.
- agent/first-publish-date
- agent/type
- agent/title
- agent/references
- agent/author
- agent/source
- agent/description
- agent/severity
- agent/guess-ai
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/event
- agent/tags
- collector/nvd-api
- source/NVD
- vendor/linux
- canonical/linux kernel
- version/linux kernel/5.17