LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50067: btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()

In the Linux kernel, the following vulnerability has been resolved: btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() In btrfs_relocate_block_group(), the rc is allocated. Then btrfs_relocate_block_group() calls relocate_block_group() prepare_to_relocate() set_reloc_control() that assigns rc to the variable fs_info->reloc_ctl. When prepare_to_relocate() returns, it calls btrfs_commit_transaction() btrfs_start_dirty_block_groups() btrfs_alloc_path() kmem_cache_zalloc() which may fail for example (or other errors could happen). When the failure occurs, btrfs_relocate_block_group() detects the error and frees rc and doesn't set fs_info->reloc_ctl to NULL. After that, in btrfs_init_reloc_root(), rc is retrieved from fs_info->reloc_ctl and then used, which may cause a use-after-free bug. This possible bug can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag(). To fix this possible bug, in prepare_to_relocate(), check if btrfs_commit_transaction() fails. If the failure occurs, unset_reloc_control() is called to set fs_info->reloc_ctl to NULL. The error log in our fault-injection testing is shown as follows: [ 58.751070] BUG: KASAN: use-after-free in btrfs_init_reloc_root+0x7ca/0x920 [btrfs] ... [ 58.753577] Call Trace: ... [ 58.755800] kasan_report+0x45/0x60 [ 58.756066] btrfs_init_reloc_root+0x7ca/0x920 [btrfs] [ 58.757304] record_root_in_trans+0x792/0xa10 [btrfs] [ 58.757748] btrfs_record_root_in_trans+0x463/0x4f0 [btrfs] [ 58.758231] start_transaction+0x896/0x2950 [btrfs] [ 58.758661] btrfs_defrag_root+0x250/0xc00 [btrfs] [ 58.759083] btrfs_ioctl_defrag+0x467/0xa00 [btrfs] [ 58.759513] btrfs_ioctl+0x3c95/0x114e0 [btrfs] ... [ 58.768510] Allocated by task 23683: [ 58.768777] ____kasan_kmalloc+0xb5/0xf0 [ 58.769069] __kmalloc+0x227/0x3d0 [ 58.769325] alloc_reloc_control+0x10a/0x3d0 [btrfs] [ 58.769755] btrfs_relocate_block_group+0x7aa/0x1e20 [btrfs] [ 58.770228] btrfs_relocate_chunk+0xf1/0x760 [btrfs] [ 58.770655] __btrfs_balance+0x1326/0x1f10 [btrfs] [ 58.771071] btrfs_balance+0x3150/0x3d30 [btrfs] [ 58.771472] btrfs_ioctl_balance+0xd84/0x1410 [btrfs] [ 58.771902] btrfs_ioctl+0x4caa/0x114e0 [btrfs] ... [ 58.773337] Freed by task 23683: ... [ 58.774815] kfree+0xda/0x2b0 [ 58.775038] free_reloc_control+0x1d6/0x220 [btrfs] [ 58.775465] btrfs_relocate_block_group+0x115c/0x1e20 [btrfs] [ 58.775944] btrfs_relocate_chunk+0xf1/0x760 [btrfs] [ 58.776369] __btrfs_balance+0x1326/0x1f10 [btrfs] [ 58.776784] btrfs_balance+0x3150/0x3d30 [btrfs] [ 58.777185] btrfs_ioctl_balance+0xd84/0x1410 [btrfs] [ 58.777621] btrfs_ioctl+0x4caa/0x114e0 [btrfs] ...

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel Btrfs bug that can leave a freed internal relocation object referenced after an error. On affected systems, later Btrfs operations may hit a use-after-free and crash or behave unpredictably. The source does not provide CVSS, confirmed exploitation, or a complete product matrix.

Executive priority

Treat this as a targeted kernel maintenance issue, not an internet-wide emergency based on available evidence. Prioritize Btrfs servers and storage workloads, then fold remediation into kernel patch cycles once vendor-fixed packages are confirmed.

Technical view

The flaw is in Btrfs relocation handling. If btrfs_commit_transaction() fails inside prepare_to_relocate(), fs_info->reloc_ctl can still point to freed reloc control data. A later btrfs_init_reloc_root() can dereference it, producing a KASAN-reported use-after-free. The fix clears reloc control on commit failure.

Likely exposure

Exposure appears limited to Linux systems running affected kernels with Btrfs in use. The source lists Linux kernel versions including 5.13, 5.15.63, 5.19.4, and 6.0 as affected, but does not provide a simple distribution package matrix.

Exploitation context

The source describes a possible trigger sequence involving Btrfs balance before Btrfs defrag and shows fault-injection testing output. It does not claim public exploitation, exploit availability, remote reachability, privilege requirements, or CISA KEV listing.

Researcher notes

Evidence supports a kernel memory safety bug with a fault-injection reproduction path, but not real-world exploitation. The key condition is stale fs_info->reloc_ctl after relocation setup and transaction commit failure. Validate against actual downstream backports rather than upstream version labels alone.

Mitigation direction

  • Update affected Linux kernels to a stable or distribution release containing the referenced Btrfs fix.
  • Prioritize systems using Btrfs, especially where balance and defrag operations are performed.
  • Check Linux distribution advisories for backported fixes and exact package versions.
  • If patching is delayed, limit Btrfs maintenance operations to trusted administrators.

Validation and detection

  • Inventory Linux hosts using Btrfs filesystems and record kernel versions.
  • Compare installed kernels against distribution advisories and the referenced stable commits.
  • Confirm patched kernels include the fix clearing reloc control on commit failure.
  • Review logs for Btrfs crashes, KASAN use-after-free reports, or related kernel oops events.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50067 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1a5353475df8fcaf200fecc9e961a3900d15e891, 499d29bf151951399367ba83645abfdb429a3af9, 4223d91ca1b5bf3928e5722c3c6b3fdb49250ab3, 6f371623f315c26100e603c2e8837cdbe130f9e0, fb686c6824dd6294ca772b92424b8fba666e7d00, fb686c6824dd6294ca772b92424b8fba666e7d00, fb686c6824dd6294ca772b92424b8fba666e7d00unaffected
LinuxLinux5.13, 0, 5.15.63, 5.19.4, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.