CVE-2022-49914: btrfs: fix inode list leak during backref walking at resolve_indirect_refs()
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix inode list leak during backref walking at resolveindirectrefs()
During backref walking, at resolveindirectrefs(), if we get an error we jump to the 'out' label and call ulistfree() on the 'parents' ulist, which frees all the elements in the ulist - however that does not free any inode lists that may be attached to elements, through the 'aux' field of a ulist node, so we end up leaking lists if we have any attached to the unodes.
Fix this by calling freeleaflist() instead of ulistfree() when we exit from resolveindirectrefs(). The static function freeleaflist() is moved up for this to be possible and it's slightly simplified by removing unnecessary code.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49914?
CVE-2022-49914 is categorized as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2022-49914?
To fix CVE-2022-49914, you should update your Linux kernel to the latest stable version provided by your distribution.
What are the potential impacts of exploiting CVE-2022-49914?
Exploiting CVE-2022-49914 may lead to memory leaks and potential denial of service conditions.
Which versions of the Linux kernel are affected by CVE-2022-49914?
CVE-2022-49914 affects multiple versions of the Linux kernel prior to the resolution in the latest releases.
Is there a workaround for CVE-2022-49914?
There are no specific workarounds for CVE-2022-49914; updating the kernel is the recommended action.