CVE-2022-49914

MEDIUM

Linux Kernel 3.5-6.0.8 Btrfs Use-After-Free

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix inode list leak during backref walking at resolve_indirect_refs() During backref walking, at resolve_indirect_refs(), if we get an error we jump to the 'out' label and call ulist_free() on the 'parents' ulist, which frees all the elements in the ulist - however that does not free any inode lists that may be attached to elements, through the 'aux' field of a ulist node, so we end up leaking lists if we have any attached to the unodes. Fix this by calling free_leaf_list() instead of ulist_free() when we exit from resolve_indirect_refs(). The static function free_leaf_list() is moved up for this to be possible and it's slightly simplified by removing unnecessary code.

Scores

CVSS v3 5.5
EPSS 0.0017
EPSS Percentile 6.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-401
Status published
Products (24)
linux/Kernel 3.5.0 - 4.14.299linux
linux/Kernel 4.15.0 - 4.19.265linux
linux/Kernel 4.20.0 - 5.4.224linux
linux/Kernel 5.11.0 - 5.15.78linux
linux/Kernel 5.16.0 - 6.0.8linux
linux/Kernel 5.5.0 - 5.10.154linux
Linux/Linux < 3.5
Linux/Linux 3.5
Linux/Linux 3301958b7c1dae8f0f5ded63aa881e0b71e78464 - 2c0329406bb28109c07c6e23e5e3e0fa618a95d7
Linux/Linux 3301958b7c1dae8f0f5ded63aa881e0b71e78464 - 396515db923ad5cbeb179d6b88927870b4cbebb7
... and 14 more
Published May 01, 2025
Tracked Since Feb 18, 2026