CVE-2022-50067 (GCVE-0-2022-50067)
Vulnerability from cvelistv5 – Published: 2025-06-18 11:02 – Updated: 2026-05-11 19:12
VLAI
EPSS
VEX
Title
btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()
In btrfs_relocate_block_group(), the rc is allocated. Then
btrfs_relocate_block_group() calls
relocate_block_group()
prepare_to_relocate()
set_reloc_control()
that assigns rc to the variable fs_info->reloc_ctl. When
prepare_to_relocate() returns, it calls
btrfs_commit_transaction()
btrfs_start_dirty_block_groups()
btrfs_alloc_path()
kmem_cache_zalloc()
which may fail for example (or other errors could happen). When the
failure occurs, btrfs_relocate_block_group() detects the error and frees
rc and doesn't set fs_info->reloc_ctl to NULL. After that, in
btrfs_init_reloc_root(), rc is retrieved from fs_info->reloc_ctl and
then used, which may cause a use-after-free bug.
This possible bug can be triggered by calling btrfs_ioctl_balance()
before calling btrfs_ioctl_defrag().
To fix this possible bug, in prepare_to_relocate(), check if
btrfs_commit_transaction() fails. If the failure occurs,
unset_reloc_control() is called to set fs_info->reloc_ctl to NULL.
The error log in our fault-injection testing is shown as follows:
[ 58.751070] BUG: KASAN: use-after-free in btrfs_init_reloc_root+0x7ca/0x920 [btrfs]
...
[ 58.753577] Call Trace:
...
[ 58.755800] kasan_report+0x45/0x60
[ 58.756066] btrfs_init_reloc_root+0x7ca/0x920 [btrfs]
[ 58.757304] record_root_in_trans+0x792/0xa10 [btrfs]
[ 58.757748] btrfs_record_root_in_trans+0x463/0x4f0 [btrfs]
[ 58.758231] start_transaction+0x896/0x2950 [btrfs]
[ 58.758661] btrfs_defrag_root+0x250/0xc00 [btrfs]
[ 58.759083] btrfs_ioctl_defrag+0x467/0xa00 [btrfs]
[ 58.759513] btrfs_ioctl+0x3c95/0x114e0 [btrfs]
...
[ 58.768510] Allocated by task 23683:
[ 58.768777] ____kasan_kmalloc+0xb5/0xf0
[ 58.769069] __kmalloc+0x227/0x3d0
[ 58.769325] alloc_reloc_control+0x10a/0x3d0 [btrfs]
[ 58.769755] btrfs_relocate_block_group+0x7aa/0x1e20 [btrfs]
[ 58.770228] btrfs_relocate_chunk+0xf1/0x760 [btrfs]
[ 58.770655] __btrfs_balance+0x1326/0x1f10 [btrfs]
[ 58.771071] btrfs_balance+0x3150/0x3d30 [btrfs]
[ 58.771472] btrfs_ioctl_balance+0xd84/0x1410 [btrfs]
[ 58.771902] btrfs_ioctl+0x4caa/0x114e0 [btrfs]
...
[ 58.773337] Freed by task 23683:
...
[ 58.774815] kfree+0xda/0x2b0
[ 58.775038] free_reloc_control+0x1d6/0x220 [btrfs]
[ 58.775465] btrfs_relocate_block_group+0x115c/0x1e20 [btrfs]
[ 58.775944] btrfs_relocate_chunk+0xf1/0x760 [btrfs]
[ 58.776369] __btrfs_balance+0x1326/0x1f10 [btrfs]
[ 58.776784] btrfs_balance+0x3150/0x3d30 [btrfs]
[ 58.777185] btrfs_ioctl_balance+0xd84/0x1410 [btrfs]
[ 58.777621] btrfs_ioctl+0x4caa/0x114e0 [btrfs]
...
Severity
7.8 (High)
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
1a5353475df8fcaf200fecc9e961a3900d15e891 , < ff0e8ed8dfb584575cffc1561f17a1d094e8565b
(git)
Affected: 499d29bf151951399367ba83645abfdb429a3af9 , < dcb11fe0a0a9cca2b7425191b9bf30dc29f2ad0f (git) Affected: 4223d91ca1b5bf3928e5722c3c6b3fdb49250ab3 , < 8e546674031fc1576da501e27a8fd165222e5a37 (git) Affected: 6f371623f315c26100e603c2e8837cdbe130f9e0 , < b60e862e133f646f19023ece1d476d630a660de1 (git) Affected: fb686c6824dd6294ca772b92424b8fba666e7d00 , < 78f8c2370e3d33e35f23bdc648653d779aeacb6e (git) Affected: fb686c6824dd6294ca772b92424b8fba666e7d00 , < 5d741afed0bac206640cc64d77b97853283cf719 (git) Affected: fb686c6824dd6294ca772b92424b8fba666e7d00 , < 85f02d6c856b9f3a0acf5219de6e32f58b9778eb (git) |
guessed | |
| Linux | Linux |
Affected:
5.13
Unaffected: 0 , < 5.13 (semver) Unaffected: 5.15.63 , ≤ 5.15.* (semver) Unaffected: 5.19.4 , ≤ 5.19.* (semver) Unaffected: 6.0 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/relocation.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ff0e8ed8dfb584575cffc1561f17a1d094e8565b",
"status": "affected",
"version": "1a5353475df8fcaf200fecc9e961a3900d15e891",
"versionType": "git"
},
{
"lessThan": "dcb11fe0a0a9cca2b7425191b9bf30dc29f2ad0f",
"status": "affected",
"version": "499d29bf151951399367ba83645abfdb429a3af9",
"versionType": "git"
},
{
"lessThan": "8e546674031fc1576da501e27a8fd165222e5a37",
"status": "affected",
"version": "4223d91ca1b5bf3928e5722c3c6b3fdb49250ab3",
"versionType": "git"
},
{
"lessThan": "b60e862e133f646f19023ece1d476d630a660de1",
"status": "affected",
"version": "6f371623f315c26100e603c2e8837cdbe130f9e0",
"versionType": "git"
},
{
"lessThan": "78f8c2370e3d33e35f23bdc648653d779aeacb6e",
"status": "affected",
"version": "fb686c6824dd6294ca772b92424b8fba666e7d00",
"versionType": "git"
},
{
"lessThan": "5d741afed0bac206640cc64d77b97853283cf719",
"status": "affected",
"version": "fb686c6824dd6294ca772b92424b8fba666e7d00",
"versionType": "git"
},
{
"lessThan": "85f02d6c856b9f3a0acf5219de6e32f58b9778eb",
"status": "affected",
"version": "fb686c6824dd6294ca772b92424b8fba666e7d00",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/relocation.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.63",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.19.*",
"status": "unaffected",
"version": "5.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.63",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.19.4",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: unset reloc control if transaction commit fails in prepare_to_relocate()\n\nIn btrfs_relocate_block_group(), the rc is allocated. Then\nbtrfs_relocate_block_group() calls\n\nrelocate_block_group()\n prepare_to_relocate()\n set_reloc_control()\n\nthat assigns rc to the variable fs_info-\u003ereloc_ctl. When\nprepare_to_relocate() returns, it calls\n\nbtrfs_commit_transaction()\n btrfs_start_dirty_block_groups()\n btrfs_alloc_path()\n kmem_cache_zalloc()\n\nwhich may fail for example (or other errors could happen). When the\nfailure occurs, btrfs_relocate_block_group() detects the error and frees\nrc and doesn\u0027t set fs_info-\u003ereloc_ctl to NULL. After that, in\nbtrfs_init_reloc_root(), rc is retrieved from fs_info-\u003ereloc_ctl and\nthen used, which may cause a use-after-free bug.\n\nThis possible bug can be triggered by calling btrfs_ioctl_balance()\nbefore calling btrfs_ioctl_defrag().\n\nTo fix this possible bug, in prepare_to_relocate(), check if\nbtrfs_commit_transaction() fails. If the failure occurs,\nunset_reloc_control() is called to set fs_info-\u003ereloc_ctl to NULL.\n\nThe error log in our fault-injection testing is shown as follows:\n\n [ 58.751070] BUG: KASAN: use-after-free in btrfs_init_reloc_root+0x7ca/0x920 [btrfs]\n ...\n [ 58.753577] Call Trace:\n ...\n [ 58.755800] kasan_report+0x45/0x60\n [ 58.756066] btrfs_init_reloc_root+0x7ca/0x920 [btrfs]\n [ 58.757304] record_root_in_trans+0x792/0xa10 [btrfs]\n [ 58.757748] btrfs_record_root_in_trans+0x463/0x4f0 [btrfs]\n [ 58.758231] start_transaction+0x896/0x2950 [btrfs]\n [ 58.758661] btrfs_defrag_root+0x250/0xc00 [btrfs]\n [ 58.759083] btrfs_ioctl_defrag+0x467/0xa00 [btrfs]\n [ 58.759513] btrfs_ioctl+0x3c95/0x114e0 [btrfs]\n ...\n [ 58.768510] Allocated by task 23683:\n [ 58.768777] ____kasan_kmalloc+0xb5/0xf0\n [ 58.769069] __kmalloc+0x227/0x3d0\n [ 58.769325] alloc_reloc_control+0x10a/0x3d0 [btrfs]\n [ 58.769755] btrfs_relocate_block_group+0x7aa/0x1e20 [btrfs]\n [ 58.770228] btrfs_relocate_chunk+0xf1/0x760 [btrfs]\n [ 58.770655] __btrfs_balance+0x1326/0x1f10 [btrfs]\n [ 58.771071] btrfs_balance+0x3150/0x3d30 [btrfs]\n [ 58.771472] btrfs_ioctl_balance+0xd84/0x1410 [btrfs]\n [ 58.771902] btrfs_ioctl+0x4caa/0x114e0 [btrfs]\n ...\n [ 58.773337] Freed by task 23683:\n ...\n [ 58.774815] kfree+0xda/0x2b0\n [ 58.775038] free_reloc_control+0x1d6/0x220 [btrfs]\n [ 58.775465] btrfs_relocate_block_group+0x115c/0x1e20 [btrfs]\n [ 58.775944] btrfs_relocate_chunk+0xf1/0x760 [btrfs]\n [ 58.776369] __btrfs_balance+0x1326/0x1f10 [btrfs]\n [ 58.776784] btrfs_balance+0x3150/0x3d30 [btrfs]\n [ 58.777185] btrfs_ioctl_balance+0xd84/0x1410 [btrfs]\n [ 58.777621] btrfs_ioctl+0x4caa/0x114e0 [btrfs]\n ..."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T19:12:13.557Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ff0e8ed8dfb584575cffc1561f17a1d094e8565b"
},
{
"url": "https://git.kernel.org/stable/c/dcb11fe0a0a9cca2b7425191b9bf30dc29f2ad0f"
},
{
"url": "https://git.kernel.org/stable/c/8e546674031fc1576da501e27a8fd165222e5a37"
},
{
"url": "https://git.kernel.org/stable/c/b60e862e133f646f19023ece1d476d630a660de1"
},
{
"url": "https://git.kernel.org/stable/c/78f8c2370e3d33e35f23bdc648653d779aeacb6e"
},
{
"url": "https://git.kernel.org/stable/c/5d741afed0bac206640cc64d77b97853283cf719"
},
{
"url": "https://git.kernel.org/stable/c/85f02d6c856b9f3a0acf5219de6e32f58b9778eb"
}
],
"title": "btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50067",
"datePublished": "2025-06-18T11:02:13.127Z",
"dateReserved": "2025-06-18T10:57:27.405Z",
"dateUpdated": "2026-05-11T19:12:13.557Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2022-50067",
"date": "2026-09-15",
"epss": "0.00208",
"percentile": "0.11147"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2022-50067\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-06-18T11:15:35.490\",\"lastModified\":\"2026-06-17T05:22:41.310\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: unset reloc control if transaction commit fails in prepare_to_relocate()\\n\\nIn btrfs_relocate_block_group(), the rc is allocated. Then\\nbtrfs_relocate_block_group() calls\\n\\nrelocate_block_group()\\n prepare_to_relocate()\\n set_reloc_control()\\n\\nthat assigns rc to the variable fs_info-\u003ereloc_ctl. When\\nprepare_to_relocate() returns, it calls\\n\\nbtrfs_commit_transaction()\\n btrfs_start_dirty_block_groups()\\n btrfs_alloc_path()\\n kmem_cache_zalloc()\\n\\nwhich may fail for example (or other errors could happen). When the\\nfailure occurs, btrfs_relocate_block_group() detects the error and frees\\nrc and doesn\u0027t set fs_info-\u003ereloc_ctl to NULL. After that, in\\nbtrfs_init_reloc_root(), rc is retrieved from fs_info-\u003ereloc_ctl and\\nthen used, which may cause a use-after-free bug.\\n\\nThis possible bug can be triggered by calling btrfs_ioctl_balance()\\nbefore calling btrfs_ioctl_defrag().\\n\\nTo fix this possible bug, in prepare_to_relocate(), check if\\nbtrfs_commit_transaction() fails. If the failure occurs,\\nunset_reloc_control() is called to set fs_info-\u003ereloc_ctl to NULL.\\n\\nThe error log in our fault-injection testing is shown as follows:\\n\\n [ 58.751070] BUG: KASAN: use-after-free in btrfs_init_reloc_root+0x7ca/0x920 [btrfs]\\n ...\\n [ 58.753577] Call Trace:\\n ...\\n [ 58.755800] kasan_report+0x45/0x60\\n [ 58.756066] btrfs_init_reloc_root+0x7ca/0x920 [btrfs]\\n [ 58.757304] record_root_in_trans+0x792/0xa10 [btrfs]\\n [ 58.757748] btrfs_record_root_in_trans+0x463/0x4f0 [btrfs]\\n [ 58.758231] start_transaction+0x896/0x2950 [btrfs]\\n [ 58.758661] btrfs_defrag_root+0x250/0xc00 [btrfs]\\n [ 58.759083] btrfs_ioctl_defrag+0x467/0xa00 [btrfs]\\n [ 58.759513] btrfs_ioctl+0x3c95/0x114e0 [btrfs]\\n ...\\n [ 58.768510] Allocated by task 23683:\\n [ 58.768777] ____kasan_kmalloc+0xb5/0xf0\\n [ 58.769069] __kmalloc+0x227/0x3d0\\n [ 58.769325] alloc_reloc_control+0x10a/0x3d0 [btrfs]\\n [ 58.769755] btrfs_relocate_block_group+0x7aa/0x1e20 [btrfs]\\n [ 58.770228] btrfs_relocate_chunk+0xf1/0x760 [btrfs]\\n [ 58.770655] __btrfs_balance+0x1326/0x1f10 [btrfs]\\n [ 58.771071] btrfs_balance+0x3150/0x3d30 [btrfs]\\n [ 58.771472] btrfs_ioctl_balance+0xd84/0x1410 [btrfs]\\n [ 58.771902] btrfs_ioctl+0x4caa/0x114e0 [btrfs]\\n ...\\n [ 58.773337] Freed by task 23683:\\n ...\\n [ 58.774815] kfree+0xda/0x2b0\\n [ 58.775038] free_reloc_control+0x1d6/0x220 [btrfs]\\n [ 58.775465] btrfs_relocate_block_group+0x115c/0x1e20 [btrfs]\\n [ 58.775944] btrfs_relocate_chunk+0xf1/0x760 [btrfs]\\n [ 58.776369] __btrfs_balance+0x1326/0x1f10 [btrfs]\\n [ 58.776784] btrfs_balance+0x3150/0x3d30 [btrfs]\\n [ 58.777185] btrfs_ioctl_balance+0xd84/0x1410 [btrfs]\\n [ 58.777621] btrfs_ioctl+0x4caa/0x114e0 [btrfs]\\n ...\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: anular el control de reubicaci\u00f3n si falla el commit de la transacci\u00f3n en prepare_to_relocate(). En btrfs_relocate_block_group(), se asigna el rc. Luego, btrfs_relocate_block_group() llama a relocate_block_group() prepare_to_relocate() set_reloc_control() que asigna rc a la variable fs_info-\u0026gt;reloc_ctl. Cuando prepare_to_relocate() retorna, llama a btrfs_commit_transaction() btrfs_start_dirty_block_groups() btrfs_alloc_path() kmem_cache_zalloc() que puede fallar, por ejemplo (o podr\u00edan ocurrir otros errores). Cuando ocurre el fallo, btrfs_relocate_block_group() detecta el error y libera rc y no establece fs_info-\u0026gt;reloc_ctl en NULL. Posteriormente, en btrfs_init_reloc_root(), se recupera rc de fs_info-\u0026gt;reloc_ctl y se utiliza, lo que podr\u00eda causar un error de Use-After-Free. Este posible error se puede activar llamando a btrfs_ioctl_balance() antes de llamar a btrfs_ioctl_defrag(). Para corregir este posible error, en prepare_to_relocate(), compruebe si btrfs_commit_transaction() falla. Si falla, se llama a unset_reloc_control() para establecer fs_info-\u0026gt;reloc_ctl en NULL. El registro de errores en nuestras pruebas de inyecci\u00f3n de fallas se muestra a continuaci\u00f3n: [ 58.751070] ERROR: KASAN: use-after-free en btrfs_init_reloc_root+0x7ca/0x920 [btrfs] ... [ 58.753577] Seguimiento de llamadas: ... [ 58.755800] kasan_report+0x45/0x60 [ 58.756066] btrfs_init_reloc_root+0x7ca/0x920 [btrfs] [ 58.757304] record_root_in_trans+0x792/0xa10 [btrfs] [ 58.757748] btrfs_record_root_in_trans+0x463/0x4f0 [btrfs] [ 58.758231] start_transaction+0x896/0x2950 [btrfs] [ 58.758661] btrfs_defrag_root+0x250/0xc00 [btrfs] [ 58.759083] btrfs_ioctl_defrag+0x467/0xa00 [btrfs] [ 58.759513] btrfs_ioctl+0x3c95/0x114e0 [btrfs] ... [ 58.768510] Asignado por la tarea 23683: [ 58.768777] ____kasan_kmalloc+0xb5/0xf0 [ 58.769069] __kmalloc+0x227/0x3d0 [ 58.769325] alloc_reloc_control+0x10a/0x3d0 [btrfs] [ 58.769755] btrfs_relocate_block_group+0x7aa/0x1e20 [btrfs] [ 58.770228] btrfs_relocate_chunk+0xf1/0x760 [btrfs] [ 58.770655] __btrfs_balance+0x1326/0x1f10 [btrfs] [ 58.771071] btrfs_balance+0x3150/0x3d30 [btrfs] [ 58.771472] btrfs_ioctl_balance+0xd84/0x1410 [btrfs] [ 58.771902] btrfs_ioctl+0x4caa/0x114e0 [btrfs] ... [ 58.773337] Liberado por la tarea 23683: ... [ 58.774815] kfree+0xda/0x2b0 [ 58.775038] free_reloc_control+0x1d6/0x220 [btrfs] [ 58.775465] btrfs_relocate_block_group+0x115c/0x1e20 [btrfs] [ 58.775944] btrfs_relocate_chunk+0xf1/0x760 [btrfs] [ 58.776369] __btrfs_balance+0x1326/0x1f10 [btrfs] [ 58.776784] btrfs_balance+0x3150/0x3d30 [btrfs] [ 58.777185] btrfs_ioctl_balance+0xd84/0x1410 [btrfs] [ 58.777621] btrfs_ioctl+0x4caa/0x114e0 [btrfs] ...\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/btrfs/relocation.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1a5353475df8fcaf200fecc9e961a3900d15e891\",\"lessThan\":\"ff0e8ed8dfb584575cffc1561f17a1d094e8565b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"499d29bf151951399367ba83645abfdb429a3af9\",\"lessThan\":\"dcb11fe0a0a9cca2b7425191b9bf30dc29f2ad0f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4223d91ca1b5bf3928e5722c3c6b3fdb49250ab3\",\"lessThan\":\"8e546674031fc1576da501e27a8fd165222e5a37\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6f371623f315c26100e603c2e8837cdbe130f9e0\",\"lessThan\":\"b60e862e133f646f19023ece1d476d630a660de1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fb686c6824dd6294ca772b92424b8fba666e7d00\",\"lessThan\":\"78f8c2370e3d33e35f23bdc648653d779aeacb6e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fb686c6824dd6294ca772b92424b8fba666e7d00\",\"lessThan\":\"5d741afed0bac206640cc64d77b97853283cf719\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fb686c6824dd6294ca772b92424b8fba666e7d00\",\"lessThan\":\"85f02d6c856b9f3a0acf5219de6e32f58b9778eb\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/btrfs/relocation.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.63\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19.4\",\"lessThanOrEqual\":\"5.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.14.318\",\"matchCriteriaId\":\"042D6334-1740-4B6A-A505-BF529664A969\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.286\",\"matchCriteriaId\":\"C6613E97-CA9E-4956-A888-2065F3C61304\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.247\",\"matchCriteriaId\":\"F1B2E171-8F3C-474F-B25A-F9110189E950\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.184\",\"matchCriteriaId\":\"DEDF9E01-A66D-486E-A184-7E8EF9C25EF9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.63\",\"matchCriteriaId\":\"D5744A03-DA40-4A78-9063-13179361DC6D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.19.4\",\"matchCriteriaId\":\"0E669300-DA42-4ACD-86D8-68BE5F29FB88\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E8BD11A3-8643-49B6-BADE-5029A0117325\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5d741afed0bac206640cc64d77b97853283cf719\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/78f8c2370e3d33e35f23bdc648653d779aeacb6e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/85f02d6c856b9f3a0acf5219de6e32f58b9778eb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8e546674031fc1576da501e27a8fd165222e5a37\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b60e862e133f646f19023ece1d476d630a660de1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dcb11fe0a0a9cca2b7425191b9bf30dc29f2ad0f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ff0e8ed8dfb584575cffc1561f17a1d094e8565b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
"redhat_vex": {
"aggregate_severity": "None",
"current_release_date": "2026-06-30T10:14:09+00:00",
"cve": "CVE-2022-50067",
"id": "CVE-2022-50067",
"initial_release_date": "2022-01-01T00:00:00+00:00",
"product_status:known_not_affected": "274",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50067.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-08-31T01:26:43Z",
"cve": "CVE-2022-50067",
"id": "CVE-2022-50067",
"initial_release_date": "2025-06-19T03:42:44Z",
"product_status:known_not_affected": "526",
"product_status:recommended": "286",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2022-50067",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50067.json",
"version": "52"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…