CVE-2022-49913: btrfs: fix inode list leak during backref walking at find_parent_nodes()
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix inode list leak during backref walking at find_parent_nodes()
During backref walking, at find_parent_nodes(), if we are dealing with a
data extent and we get an error while resolving the indirect backrefs, at
resolve_indirect_refs(), or in the while loop that iterates over the refs
in the direct refs rbtree, we end up leaking the inode lists attached to
the direct refs we have in the direct refs rbtree that were not yet added
to the refs ulist passed as argument to find_parent_nodes(). Since they
were not yet added to the refs ulist and prelim_release() does not free
the lists, on error the caller can only free the lists attached to the
refs that were added to the refs ulist, all the remaining refs get their
inode lists never freed, therefore leaking their memory.
Fix this by having prelim_release() always free any attached inode list
to each ref found in the rbtree, and have find_parent_nodes() set the
ref's inode list to NULL once it transfers ownership of the inode list
to a ref added to the refs ulist passed to find_parent_nodes().
Security readout for executives and security teams
Plain-English summary
This is a Linux kernel Btrfs memory leak fixed in stable kernel commits. Under specific error paths while walking filesystem backreferences, memory tied to inode lists may not be freed. The available sources do not provide CVSS, exploitation evidence, or a confirmed attacker model.
Executive priority
Treat as a patch-tracking item, not an emergency, unless critical systems rely heavily on Btrfs and cannot tolerate availability degradation. The evidence lacks severity scoring and exploitation confirmation.
Technical view
In Btrfs find_parent_nodes(), errors during indirect backref resolution or direct-ref iteration could leave inode lists attached to refs not transferred to the refs ulist. prelim_release() did not free those lists, causing a kernel memory leak. The fix frees attached inode lists and nulls ownership after transfer.
Likely exposure
Exposure appears limited to Linux systems running affected kernel versions with Btrfs functionality present, especially where Btrfs backreference walking is exercised. The source bundle lists Linux kernel versions and stable commits but does not define distribution package status.
Exploitation context
No source in the bundle indicates active exploitation, public exploit availability, or CISA KEV listing. The likely impact is availability-related memory leakage, but triggerability by an unprivileged attacker is not established in the provided evidence.
Researcher notes
The core issue is ownership handling for inode lists during Btrfs backref walking cleanup. Validate by code review or vendor backport metadata, not by attempting reproduction in production. Evidence is incomplete on attacker prerequisites and practical impact.
Mitigation direction
Apply vendor kernel updates that include the cited stable Btrfs fixes.
Map production kernels against vendor advisories and the CVE record.
Prioritize systems using Btrfs for active filesystems or heavy filesystem operations.
If updates are unavailable, follow vendor guidance and reduce nonessential Btrfs exposure.
Validation and detection
Confirm the running kernel contains a vendor backport of the cited fix.
Inventory Linux hosts using Btrfs filesystems or Btrfs-enabled kernel paths.
Check distribution security trackers for package-level affected and fixed versions.
Monitor memory pressure on Btrfs systems until patched.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2022-49913 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
6Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
May 1, 2025, 14:10 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.