- Vulnerability/
- CVE-2022-49913
CVE-2022-49913: btrfs: fix inode list leak during backref walking at find_parent_nodes()
First published: Thu May 01 2025(Updated: )
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix inode list leak during backref walking at find_parent_nodes() During backref walking, at find_parent_nodes(), if we are dealing with a data extent and we get an error while resolving the indirect backrefs, at resolve_indirect_refs(), or in the while loop that iterates over the refs in the direct refs rbtree, we end up leaking the inode lists attached to the direct refs we have in the direct refs rbtree that were not yet added to the refs ulist passed as argument to find_parent_nodes(). Since they were not yet added to the refs ulist and prelim_release() does not free the lists, on error the caller can only free the lists attached to the refs that were added to the refs ulist, all the remaining refs get their inode lists never freed, therefore leaking their memory. Fix this by having prelim_release() always free any attached inode list to each ref found in the rbtree, and have find_parent_nodes() set the ref's inode list to NULL once it transfers ownership of the inode list to a ref added to the refs ulist passed to find_parent_nodes().
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/6a6731a0df8c47ecc703bd7bb73459df767051e0
- https://git.kernel.org/stable/c/61e06128113711df0534c404fb6bb528eb7d2332
- https://git.kernel.org/stable/c/222a3d533027b9492d5b7f5ecdc01a90f57bb5a9
- https://git.kernel.org/stable/c/83ea8c5b54d452a5769e605e3c5c687e8ca06d89
- https://git.kernel.org/stable/c/92876eec382a0f19f33d09d2c939e9ca49038ae5
Frequently Asked Questions
What is the severity of CVE-2022-49913?
CVE-2022-49913 is classified with a medium severity due to its potential impact on data integrity within the Linux kernel.
How do I fix CVE-2022-49913?
To fix CVE-2022-49913, upgrading to the latest stable version of the Linux kernel that includes the patch is recommended.
What components are affected by CVE-2022-49913?
CVE-2022-49913 affects the btrfs file system within the Linux kernel during backref walking operations.
What kind of vulnerability is CVE-2022-49913?
CVE-2022-49913 is a data leak vulnerability that can occur during backref walking in the btrfs file system.
Who is impacted by CVE-2022-49913?
Users and administrators of Linux systems leveraging the btrfs filesystem could be impacted by CVE-2022-49913.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/author
- agent/source
- agent/tags
- agent/event
- vendor/linux
- canonical/linux kernel