PT-2025-7996 · Linux+2 · Linux Kernel+2

Published

2022-03-28

·

Updated

2025-05-22

·

CVE-2022-49068

CVSS v3.1

5.5

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.17.0-rc8+
Description A vulnerability in the Linux kernel has been resolved, related to the btrfs filesystem. The issue occurs when the btrfs get blocks direct write() function reserves temporary outstanding extents with btrfs delalloc reserve metadata() or btrfs delalloc reserve space(), but releases fewer outstanding extents than expected due to a modification of the len variable in the COW case. This can cause a warning in btrfs destroy inode() indicating that there are outstanding extents left. The vulnerability can be triggered by a short-write due to the inability to allocate a large extent, resulting in the allocation of a smaller one.
Recommendations To resolve the issue, update to a version of the Linux kernel that includes the fix for the btrfs get blocks direct write() function, which releases the correct amount of outstanding extents. As a temporary workaround, consider disabling the btrfs delalloc reserve metadata() function or restricting its use until a patch is available. However, since the exact fix version is not specified, it is recommended to update to the latest available version of the Linux kernel. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2025-06040
CVE-2022-49068

Affected Products

Astra Linux
Linux Kernel
Red Os