LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50571: btrfs: call __btrfs_remove_free_space_cache_locked on cache load failure

In the Linux kernel, the following vulnerability has been resolved: btrfs: call __btrfs_remove_free_space_cache_locked on cache load failure Now that lockdep is staying enabled through our entire CI runs I started seeing the following stack in generic/475 ------------[ cut here ]------------ WARNING: CPU: 1 PID: 2171864 at fs/btrfs/discard.c:604 btrfs_discard_update_discardable+0x98/0xb0 CPU: 1 PID: 2171864 Comm: kworker/u4:0 Not tainted 5.19.0-rc8+ #789 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014 Workqueue: btrfs-cache btrfs_work_helper RIP: 0010:btrfs_discard_update_discardable+0x98/0xb0 RSP: 0018:ffffb857c2f7bad0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8c85c605c200 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffffff86807c5b RDI: ffffffff868a831e RBP: ffff8c85c4c54000 R08: 0000000000000000 R09: 0000000000000000 R10: ffff8c85c66932f0 R11: 0000000000000001 R12: ffff8c85c3899010 R13: ffff8c85d5be4f40 R14: ffff8c85c4c54000 R15: ffff8c86114bfa80 FS: 0000000000000000(0000) GS:ffff8c863bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2e7f168160 CR3: 000000010289a004 CR4: 0000000000370ee0 Call Trace: __btrfs_remove_free_space_cache+0x27/0x30 load_free_space_cache+0xad2/0xaf0 caching_thread+0x40b/0x650 ? lock_release+0x137/0x2d0 btrfs_work_helper+0xf2/0x3e0 ? lock_is_held_type+0xe2/0x140 process_one_work+0x271/0x590 ? process_one_work+0x590/0x590 worker_thread+0x52/0x3b0 ? process_one_work+0x590/0x590 kthread+0xf0/0x120 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 This is the code ctl = block_group->free_space_ctl; discard_ctl = &block_group->fs_info->discard_ctl; lockdep_assert_held(&ctl->tree_lock); We have a temporary free space ctl for loading the free space cache in order to avoid having allocations happening while we're loading the cache. When we hit an error we free it all up, however this also calls btrfs_discard_update_discardable, which requires block_group->free_space_ctl->tree_lock to be held. However this is our temporary ctl so this lock isn't held. Fix this by calling __btrfs_remove_free_space_cache_locked instead so that we only clean up the entries and do not mess with the discardable stats.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

A bug in the Linux kernel's btrfs filesystem could trigger an internal locking warning when the free space cache fails to load. It is a code-correctness issue surfaced through kernel testing, not a known attack vector. Linux maintainers have published a fix; systems running btrfs on affected kernels should apply distribution updates during normal patching cycles.

Executive priority

Low priority. Apply during routine kernel patching cycles for systems running btrfs on Linux 5.11 through 5.19.x; no evidence of active exploitation or remote risk.

Technical view

In btrfs, when load_free_space_cache hits an error path it called btrfs_discard_update_discardable on a temporary free_space_ctl whose tree_lock was not held, violating a lockdep assertion in fs/btrfs/discard.c. The patch switches the error cleanup to __btrfs_remove_free_space_cache_locked, which removes entries without touching discardable stats. Affects Linux 5.11 through 5.19.17 and 6.1 prior to the fix.

Likely exposure

Linux systems using the btrfs filesystem with kernels in the 5.11 through 5.19.x range, and 6.1 prior to the fix. Servers, workstations, NAS devices, and embedded Linux appliances that mount btrfs volumes are in scope. Non-btrfs deployments are unaffected.

Exploitation context

No exploitation reported and not listed in CISA KEV. The bug surfaces as a lockdep warning during btrfs free space cache load failure, indicating a locking correctness issue rather than a documented privilege escalation or remote attack vector. Sources do not assign CVSS or CWE.

Researcher notes

Issue is in fs/btrfs/discard.c where btrfs_discard_update_discardable was invoked against a temporary free_space_ctl whose tree_lock was not held, tripping lockdep_assert_held. Fix replaces __btrfs_remove_free_space_cache with __btrfs_remove_free_space_cache_locked on the error path so discardable stats are not touched. No CVSS, CWE, or KEV entry; severity reported as unknown. Verify backports for downstream LTS kernels and any vendor btrfs forks.

Mitigation direction

  • Update to a Linux kernel that includes the upstream btrfs fix commits referenced by kernel.org stable.
  • Track your distribution's security advisories for backported btrfs patches to 5.15 and 5.10 LTS branches.
  • On btrfs systems, schedule the kernel update during the next maintenance window.
  • If patching is delayed, monitor kernel logs for btrfs warnings and free space cache load failures.

Validation and detection

  • Run 'uname -r' and confirm the kernel build includes the upstream btrfs commits or distribution-backported fix.
  • Inventory hosts using btrfs by checking 'findmnt -t btrfs' or '/proc/mounts' across the fleet.
  • Review kernel logs (dmesg, journalctl) for prior btrfs lockdep warnings from btrfs_discard_update_discardable.
  • Check vendor advisories (Red Hat, SUSE, Ubuntu, Debian) for the CVE-2022-50571 fix status.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50571 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxcd79909bc7cdd8043a22d699aae1e8435792c824, cd79909bc7cdd8043a22d699aae1e8435792c824unaffected
LinuxLinux5.11, 0, 5.19.17, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.