PT-2025-26015 · Linux+2 · Linux Kernel+2

Published 2025-06-18 · Updated 2025-06-18 · CVE-2022-50089

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.16.0-rc1+

Description A vulnerability in the Linux kernel has been resolved, related to the btrfs file system. The issue causes a hang when the cow file range() function fails during allocation, leaving pages locked. This occurs when the function is called with the unlock parameter set to 0 and allocation fails for one part of the split region. The vulnerability can lead to a hung task, as reported in a zoned btrfs setup. The estimated number of potentially affected devices is not specified.

Recommendations For Linux kernel versions prior to 5.16.0-rc1+, update to a newer version that includes the fix for this issue. As a temporary workaround, consider disabling the cow file range() function until a patch is available. Restrict access to the vulnerable btrfs module to minimize the risk of exploitation. Avoid using the do allocation zoned() function in the affected API endpoint until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2022-50089

Affected Products

Astra Linux

Linux Kernel

Btrfs

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50089.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-50089 · Vendor Advisory
• https://git.kernel.org/stable/c/b367f125c80fa838eae49e3b138dc67dfc9f46ef · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-50089 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-50089 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-50089 · Security Note
• https://osv.dev/vulnerability/CVE-2022-50089 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-50089 · Security Note
• https://ubuntu.com/security/CVE-2022-50089 · Vendor Advisory
• https://git.kernel.org/stable/c/e160aa87c87a9c4e0c8d1430235f715a3a91e2cd · Patch
• https://git.kernel.org/stable/c/9535ec371d741fa037e37eddc0a5b25ba82d0027 · Patch
• https://git.kernel.org/stable/c/9ce7466f372d83054c7494f6b3e4b9abaf3f0355 · Patch
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://twitter.com/CVEnew/status/1935356193486020853 · Twitter Post