PT-2025-40141 · Linux+2 · Linux Kernel+2

Published 2022-12-20 · Updated 2025-10-23 · CVE-2022-50456

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.12.0-07246-g75175d5adc74-dirty #199

Description The Linux kernel contains a flaw in the BTRFS file system related to resolving back references for inline extents followed by preallocated extents. Specifically, if a file includes an inline extent immediately followed by a regular or preallocated extent, attempting to resolve a logical address within the non-inline region can lead to reading an invalid offset field from the inline extent. This can cause a general protection fault and system panic. The issue occurs when add all parents attempts to access the offset field of the inline extent, potentially going beyond the end of the extent block.

Recommendations Update to version 5.12.0-07246-g75175d5adc74-dirty #199 or a later version that includes the fix.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2026-02341

CVE-2022-50456

SUSE-SU-2025:03614-1

SUSE-SU-2025:03615-1

SUSE-SU-2025:03628-1

SUSE-SU-2025:3716-1

SUSE-SU-2025:3761-1

Affected Products

Btrfs

Linux Kernel

Suse

References · 991

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50456.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-50456 · Security Note
• https://git.kernel.org/stable/c/0061ab5153fb8bc574b44fbb773680d0ede48c9c · Patch
• https://git.kernel.org/stable/c/c59ee1528b3432ec9dca220567f7eb507820917a · Patch
• https://bdu.fstec.ru/vul/2026-02341 · Security Note
• https://git.kernel.org/stable/c/a94b90ac1f251d1007c0c43ee289a61b50f2505f · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-50456 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-50456 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:3761-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-50456 · Vendor Advisory
• https://git.kernel.org/stable/c/560840afc3e63bbe5d9c5ef6b2ecf8f3589adff6 · Patch
• https://git.kernel.org/stable/c/645e2dac6e97f756f28a2f82b2e7bf7f29a68827 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:03614-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-50456 · Vendor Advisory
• https://git.kernel.org/stable/c/99590f29b2b7567fda2b503aa3d81a0d3e09dce5 · Patch