PT-2025-26016 · Linux+1 · Linux Kernel+1

Published 2022-07-09 · Updated 2026-05-26 · CVE-2022-50090

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the Linux kernel, specifically with the btrfs filesystem. On zoned filesystems, data write out is limited by max zone append size, and a large ordered extent is split according to the size of a bio. However, the number of extents to be written is calculated using BTRFS MAX EXTENT SIZE, which can lead to an incorrect estimation of the required metadata bytes. This can cause the reserved metadata to run out, especially if BTRFS MAX EXTENT SIZE is greater than max zone append size. The problem can result in a warning on small RAM environments with disabled metadata over-commit.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2026-03399

CVE-2022-50090

Affected Products

Astra Linux

Linux Kernel

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50090.json · Exploit
• https://git.kernel.org/stable/c/f7b12a62f008a3041f42f2426983e59a6a0a3c59 · Patch
• https://git.kernel.org/stable/c/6cb4b96df97082a54634ba02196516919cda228c · Patch
• https://git.kernel.org/stable/c/1aa262c1d056551dd1246115af8b7e351184deae · Patch
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2022-50090 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03399 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-50090 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-50090 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-50090 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2022-50090 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-50090 · Vendor Advisory
• https://git.kernel.org/stable/c/096e8eb9639b342bc35f9b741cf05e26d0106e92 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-50090 · Security Note
• https://ubuntu.com/security/CVE-2022-50090 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-50090 · Vendor Advisory