Security readout for executives and security teams
Plain-English summary
This is a Linux kernel Btrfs bug that can leave the filesystem quota state pointing at freed memory. A local user may be able to trigger a crash or denial of service under specific timing conditions. The source data does not show active exploitation.
Executive priority
Treat this as a moderate operational stability risk, not an internet-facing emergency. Prioritize patching on shared Linux systems, multi-user servers, and hosts using Btrfs quotas. Normal kernel maintenance windows are appropriate unless local untrusted users are present.
Technical view
CVE-2022-50379 is a race condition in Btrfs quota enablement versus quota rescan ioctl handling. If qgroup rescan initialization fails with an in-progress state, quota_root could be freed while fs_info->quota_root still references it, creating a potential use-after-free and availability impact.
Likely exposure
Exposure is limited to Linux systems running affected kernel versions with Btrfs functionality relevant to quotas and rescans. The attack vector is local, requires low privileges, and has high complexity. Confirm actual exposure through distribution kernel advisories because vendor backports may change version-based conclusions.
Exploitation context
The CVE record marks this as not in CISA KEV, and the provided sources do not cite active exploitation. CVSS 3.1 is 4.7, reflecting local access, high attack complexity, low privileges, no confidentiality or integrity impact, and high availability impact.
Researcher notes
The key condition is the race between btrfs_quota_enable() and quota rescan initialization. The fix behavior described is to ignore -EINPROGRESS and assert no other error. Sources do not provide exploit proof, affected distributions, or non-patch mitigations.
Mitigation direction
- Apply Linux kernel or distribution updates containing the referenced Btrfs fix.
- Prioritize systems using Btrfs quotas or quota rescan workflows.
- Check distribution advisories for backported fixes before relying on upstream version numbers.
- Restrict local shell access to trusted users where feasible.
- If patching is delayed, monitor vendor guidance for operational workarounds.
Validation and detection
- Inventory Linux hosts using Btrfs filesystems and quota features.
- Record kernel versions and compare them with vendor security advisories.
- Confirm installed kernels include the relevant stable fix or distribution backport.
- Review crash, oops, or filesystem logs for Btrfs quota-related instability.
- Track remediation status separately for upstream kernels and distribution kernels.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-362: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-50379 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H13.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.7MediumVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c97f6d528c3f1c83a6b792a8a7928c236c80b8feCVE reference
- https://git.kernel.org/stable/c/26b7c0ac49a3eea15559c9d84863736a6d1164b4CVE reference
- https://git.kernel.org/stable/c/47b5ffe86332af95f0f52be0a63d4da7c2b37b55CVE reference
- https://git.kernel.org/stable/c/4b996a3014ef014af8f97b60c35f5289210a4720CVE reference
- https://git.kernel.org/stable/c/0efd9dfc00d677a1d0929319a6103cb2dfc41c22CVE reference
- https://git.kernel.org/stable/c/6c22f86dd221eba0c7af645b1af73dcbc04ee27bCVE reference
- https://git.kernel.org/stable/c/331cd9461412e103d07595a10289de90004ac890CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.