LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49913: btrfs: fix inode list leak during backref walking at find_parent_nodes()

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix inode list leak during backref walking at find_parent_nodes() During backref walking, at find_parent_nodes(), if we are dealing with a data extent and we get an error while resolving the indirect backrefs, at resolve_indirect_refs(), or in the while loop that iterates over the refs in the direct refs rbtree, we end up leaking the inode lists attached to the direct refs we have in the direct refs rbtree that were not yet added to the refs ulist passed as argument to find_parent_nodes(). Since they were not yet added to the refs ulist and prelim_release() does not free the lists, on error the caller can only free the lists attached to the refs that were added to the refs ulist, all the remaining refs get their inode lists never freed, therefore leaking their memory. Fix this by having prelim_release() always free any attached inode list to each ref found in the rbtree, and have find_parent_nodes() set the ref's inode list to NULL once it transfers ownership of the inode list to a ref added to the refs ulist passed to find_parent_nodes().

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel Btrfs memory leak fixed in stable kernel commits. Under specific error paths while walking filesystem backreferences, memory tied to inode lists may not be freed. The available sources do not provide CVSS, exploitation evidence, or a confirmed attacker model.

Executive priority

Treat as a patch-tracking item, not an emergency, unless critical systems rely heavily on Btrfs and cannot tolerate availability degradation. The evidence lacks severity scoring and exploitation confirmation.

Technical view

In Btrfs find_parent_nodes(), errors during indirect backref resolution or direct-ref iteration could leave inode lists attached to refs not transferred to the refs ulist. prelim_release() did not free those lists, causing a kernel memory leak. The fix frees attached inode lists and nulls ownership after transfer.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions with Btrfs functionality present, especially where Btrfs backreference walking is exercised. The source bundle lists Linux kernel versions and stable commits but does not define distribution package status.

Exploitation context

No source in the bundle indicates active exploitation, public exploit availability, or CISA KEV listing. The likely impact is availability-related memory leakage, but triggerability by an unprivileged attacker is not established in the provided evidence.

Researcher notes

The core issue is ownership handling for inode lists during Btrfs backref walking cleanup. Validate by code review or vendor backport metadata, not by attempting reproduction in production. Evidence is incomplete on attacker prerequisites and practical impact.

Mitigation direction

  • Apply vendor kernel updates that include the cited stable Btrfs fixes.
  • Map production kernels against vendor advisories and the CVE record.
  • Prioritize systems using Btrfs for active filesystems or heavy filesystem operations.
  • If updates are unavailable, follow vendor guidance and reduce nonessential Btrfs exposure.

Validation and detection

  • Confirm the running kernel contains a vendor backport of the cited fix.
  • Inventory Linux hosts using Btrfs filesystems or Btrfs-enabled kernel paths.
  • Check distribution security trackers for package-level affected and fixed versions.
  • Monitor memory pressure on Btrfs systems until patched.
Prepared
Confidence
medium
Sources
7

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49913 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux86d5f994425252d8a40e2184c94a2682ae8ecfbf, 86d5f994425252d8a40e2184c94a2682ae8ecfbf, 86d5f994425252d8a40e2184c94a2682ae8ecfbf, 86d5f994425252d8a40e2184c94a2682ae8ecfbf, 86d5f994425252d8a40e2184c94a2682ae8ecfbfunaffected
LinuxLinux4.14, 0, 5.4.224, 5.10.154, 5.15.78, 6.0.8, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.