{
  "cveId": "CVE-2022-49898",
  "url": "https://patchblox.com/security/cve/CVE-2022-49898",
  "summary": "CVE-2022-49898 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49898, released May 1, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  btrfs: fix tree mod log mishandling of reallocat...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  btrfs: fix tree mod log mishandling of reallocated nodes  We have been seeing the following panic in production    kernel BUG at fs/btrfs/tree-mod-log.c:677!   invalid opcode: 0000 [#1] SMP   RIP: 0010:tree_mod_log_rewind\u002B0x1b4/0x200   RSP: 0000:ffffc9002c02f890 EFLAGS: 00010293   RAX: 0000000000000003 RBX: ffff8882b448c700 RCX: 0000000000000000   RDX: 0000000000008000 RSI: 00000000000000a7 RDI: ffff88877d831c00   RBP: 0000000000000002 R08: 000000000000009f R09: 0000000000000000   R10: 0000000000000000 R11: 0000000000100c40 R12: 0000000000000001   R13: ffff8886c26d6a00 R14: ffff88829f5424f8 R15: ffff88877d831a00   FS:  00007fee1d80c780(0000) GS:ffff8890400c0000(0000) knlGS:0000000000000000   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033   CR2: 00007fee1963a020 CR3: 0000000434f33002 CR4: 00000000007706e0   DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000   DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400   PKRU: 55555554   Call Trace:    btrfs_get_old_root\u002B0x12b/0x420    btrfs_search_old_slot\u002B0x64/0x2f0    ? tree_mod_log_oldest_root\u002B0x3d/0xf0    resolve_indirect_ref\u002B0xfd/0x660    ? ulist_alloc\u002B0x31/0x60    ? kmem_cache_alloc_trace\u002B0x114/0x2c0    find_parent_nodes\u002B0x97a/0x17e0    ? ulist_alloc\u002B0x30/0x60    btrfs_find_all_roots_safe\u002B0x97/0x150    iterate_extent_inodes\u002B0x154/0x370    ? btrfs_search_path_in_tree\u002B0x240/0x240    iterate_inodes_from_logical\u002B0x98/0xd0    ? btrfs_search_path_in_tree\u002B0x240/0x240    btrfs_ioctl_logical_to_ino\u002B0xd9/0x180    btrfs_ioctl\u002B0xe2/0x2ec0    ? __mod_memcg_lruvec_state\u002B0x3d/0x280    ? do_sys_openat2\u002B0x6d/0x140    ? kretprobe_dispatcher\u002B0x47/0x70    ? kretprobe_rethook_handler\u002B0x38/0x50    ? rethook_trampoline_handler\u002B0x82/0x140    ? arch_rethook_trampoline_callback\u002B0x3b/0x50    ? kmem_cache_free\u002B0xfb/0x270    ? do_sys_openat2\u002B0xd5/0x140    __x64_sys_ioctl\u002B0x71/0xb0    do_syscall_64\u002B0x2d/0x40  Which is this code in tree_mod_log_rewind()  \tswitch (tm-\u003Eop) {         case BTRFS_MOD_LOG_KEY_REMOVE_WHILE_FREEING: \t\tBUG_ON(tm-\u003Eslot \u003C n);  This occurs because we replay the nodes in order that they happened, and when we do a REPLACE we will log a REMOVE_WHILE_FREEING for every slot, starting at 0.  \u0027n\u0027 here is the number of items in this block, which in this case was 1, but we had 2 REMOVE_WHILE_FREEING operations.  The actual root cause of this was that we were replaying operations for a block that shouldn\u0027t have been replayed.  Consider the following sequence of events  1. We have an already modified root, and we do a btrfs_get_tree_mod_seq(). 2. We begin removing items from this root, triggering KEY_REPLACE for    it\u0027s child slots. 3. We remove one of the 2 children this root node points to, thus triggering    the root node promotion of the remaining child, and freeing this node. 4. We modify a new root, and re-allocate the above node to the root node of    this other root.  The tree mod log looks something like this  \tlogical 0\top KEY_REPLACE (slot 1)\t\t\tseq 2 \tlogical 0\top KEY_REMOVE (slot 1)\t\t\tseq 3 \tlogical 0\top KEY_REMOVE_WHILE_FREEING (slot 0)\tseq 4 \tlogical 4096\top LOG_ROOT_REPLACE (old logical 0)\tseq 5 \tlogical 8192\top KEY_REMOVE_WHILE_FREEING (slot 1)\tseq 6 \tlogical 8192\top KEY_REMOVE_WHILE_FREEING (slot 0)\tseq 7 \tlogical 0\top LOG_ROOT_REPLACE (old logical 8192)\tseq 8  \u003EFrom here the bug is triggered by the following steps  1.  Call btrfs_get_old_root() on the new_root. 2.  We call tree_mod_log_oldest_root(btrfs_root_node(new_root)), which is     currently logical 0. 3.  tree_mod_log_oldest_root() calls tree_mod_log_search_oldest(), which     gives us the KEY_REPLACE seq 2, and since that\u0027s not a     LOG_ROOT_REPLACE we incorrectly believe that we don\u0027t have an old     root, because we expect that the most recent change should be a     LOG_ROOT_REPLACE. 4.  Back in tree_mod_log_oldest_root() we don\u0027t have a LOG_ROOT_REPLACE,     so we don\u0027t set old_root, we simply use our e ---truncated---",
  "published": "2025-05-01T15:16:14Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.0021,
  "epssPercentile": 0.11283,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.0.8-1",
      "fix": "DEBIAN-CVE-2022-49898",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49898",
      "released": "2025-05-01T15:16:14Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.0.8-1",
      "fix": "DEBIAN-CVE-2022-49898",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49898",
      "released": "2025-05-01T15:16:14Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.0.8-1",
      "fix": "DEBIAN-CVE-2022-49898",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49898",
      "released": "2025-05-01T15:16:14Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}