LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49849: btrfs: fix match incorrectly in dev_args_match_device

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix match incorrectly in dev_args_match_device syzkaller found a failed assertion: assertion failed: (args->devid != (u64)-1) || args->missing, in fs/btrfs/volumes.c:6921 This can be triggered when we set devid to (u64)-1 by ioctl. In this case, the match of devid will be skipped and the match of device may succeed incorrectly. Patch 562d7b1512f7 introduced this function which is used to match device. This function contains two matching scenarios, we can distinguish them by checking the value of args->missing rather than check whether args->devid and args->uuid is default value.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel Btrfs flaw can make device matching behave incorrectly when a crafted device ID value is supplied through an ioctl. The public data does not state business impact, CVSS, or active exploitation. Treat it as a kernel maintenance risk for systems using Btrfs on affected kernel versions.

Executive priority

Track this as a patch-management item for Linux fleets using Btrfs. Escalate priority if affected kernels are present on multi-user, container-hosting, or storage-critical systems, but the public evidence does not support emergency treatment.

Technical view

The bug is in Btrfs dev_args_match_device. A devid value of (u64)-1 can cause devid matching to be skipped and device matching to succeed incorrectly, triggering a failed assertion reported by syzkaller. The fix changes matching logic to distinguish scenarios using args->missing.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions or unfixed backports where Btrfs is enabled or used. The bundle lists Linux 5.16, 5.15.79, 6.0.9, and 6.1 as affected, but distribution-specific backport status must be verified.

Exploitation context

The bundle says syzkaller triggered the assertion through ioctl-controlled input. It does not cite public exploitation, weaponized proof of concept, or CISA KEV listing. Active exploitation should not be assumed from the available evidence.

Researcher notes

Key evidence is the kernel fix text and CVE metadata. Missing data includes CVSS, CWE, exact security impact, privilege requirements, and distribution fix matrix. Validation should focus on kernel lineage, Btrfs usage, and vendor backport status.

Mitigation direction

  • Apply vendor-supported kernel updates that include the linked stable fixes.
  • Check distribution advisories for backported Btrfs fixes.
  • Prioritize systems using Btrfs on listed affected kernel versions.
  • Avoid direct wrangler or deployment assumptions; follow kernel vendor maintenance guidance.

Validation and detection

  • Inventory Linux hosts and record running kernel versions.
  • Identify systems with Btrfs enabled or mounted.
  • Compare kernel packages against vendor advisories and fixed stable commits.
  • Confirm whether the vendor has backported the Btrfs fix.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49849 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux5578b681fbf2b22d61189a2539efd3009518b328, 562d7b1512f7369a19bca2883e2e8672d78f0481, 562d7b1512f7369a19bca2883e2e8672d78f0481unaffected
LinuxLinux5.16, 0, 5.15.79, 6.0.9, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.