PT-2025-53132 · Btrfs+2 · Btrfs+2

Published 2025-12-24 · Updated 2026-03-14 · CVE-2022-50766

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel related to the btrfs file system. Specifically, the issue involves the order of operations within the btrfs init new buffer() function. The btrfs set header generation() function was incorrectly positioned after the call to btrfs clean tree block(). This could lead to uninitialized values being used within the btrfs clean tree block() function, potentially causing issues with extent buffer handling. The problem originated from a deduplication effort and was exacerbated by changes in how nodesize and leafsize are handled. The btrfs clean tree block() function calls btrfs header generation(), and the memzero extent buffer() function resets the header structure, necessitating the correct order of operations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2022-50766

Affected Products

Debian

Linux Kernel

Btrfs

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50766.json · Exploit
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2022-50766 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-50766 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-50766 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-50766 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-50766 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-50766 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-50766 · Security Note
• https://osv.dev/vulnerability/CVE-2022-50766 · Vendor Advisory
• https://git.kernel.org/stable/c/0a408c6212c16b9a2a1141d3c531247582ef8101 · Note
• https://git.kernel.org/stable/c/a687c2890fe4a2acaac6941fa4097a1264d8f3eb · Note
• https://twitter.com/CVEnew/status/2004294892441244053 · Twitter Post
• https://git.kernel.org/stable/c/89bc41c92d10b905c60f6ec13c9ef664a3555c54 · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://git.kernel.org/stable/c/cbddcc4fa3443fe8cfb2ff8e210deb1f6a0eea38 · Note