{
  "cveId": "CVE-2022-50067",
  "url": "https://patchblox.com/security/cve/CVE-2022-50067",
  "summary": "CVE-2022-50067 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-50067, released June 18, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  btrfs: unset reloc control if transaction commit...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()  In btrfs_relocate_block_group(), the rc is allocated.  Then btrfs_relocate_block_group() calls  relocate_block_group()   prepare_to_relocate()     set_reloc_control()  that assigns rc to the variable fs_info-\u003Ereloc_ctl. When prepare_to_relocate() returns, it calls  btrfs_commit_transaction()   btrfs_start_dirty_block_groups()     btrfs_alloc_path()       kmem_cache_zalloc()  which may fail for example (or other errors could happen). When the failure occurs, btrfs_relocate_block_group() detects the error and frees rc and doesn\u0027t set fs_info-\u003Ereloc_ctl to NULL. After that, in btrfs_init_reloc_root(), rc is retrieved from fs_info-\u003Ereloc_ctl and then used, which may cause a use-after-free bug.  This possible bug can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag().  To fix this possible bug, in prepare_to_relocate(), check if btrfs_commit_transaction() fails. If the failure occurs, unset_reloc_control() is called to set fs_info-\u003Ereloc_ctl to NULL.  The error log in our fault-injection testing is shown as follows:    [   58.751070] BUG: KASAN: use-after-free in btrfs_init_reloc_root\u002B0x7ca/0x920 [btrfs]   ...   [   58.753577] Call Trace:   ...   [   58.755800]  kasan_report\u002B0x45/0x60   [   58.756066]  btrfs_init_reloc_root\u002B0x7ca/0x920 [btrfs]   [   58.757304]  record_root_in_trans\u002B0x792/0xa10 [btrfs]   [   58.757748]  btrfs_record_root_in_trans\u002B0x463/0x4f0 [btrfs]   [   58.758231]  start_transaction\u002B0x896/0x2950 [btrfs]   [   58.758661]  btrfs_defrag_root\u002B0x250/0xc00 [btrfs]   [   58.759083]  btrfs_ioctl_defrag\u002B0x467/0xa00 [btrfs]   [   58.759513]  btrfs_ioctl\u002B0x3c95/0x114e0 [btrfs]   ...   [   58.768510] Allocated by task 23683:   [   58.768777]  ____kasan_kmalloc\u002B0xb5/0xf0   [   58.769069]  __kmalloc\u002B0x227/0x3d0   [   58.769325]  alloc_reloc_control\u002B0x10a/0x3d0 [btrfs]   [   58.769755]  btrfs_relocate_block_group\u002B0x7aa/0x1e20 [btrfs]   [   58.770228]  btrfs_relocate_chunk\u002B0xf1/0x760 [btrfs]   [   58.770655]  __btrfs_balance\u002B0x1326/0x1f10 [btrfs]   [   58.771071]  btrfs_balance\u002B0x3150/0x3d30 [btrfs]   [   58.771472]  btrfs_ioctl_balance\u002B0xd84/0x1410 [btrfs]   [   58.771902]  btrfs_ioctl\u002B0x4caa/0x114e0 [btrfs]   ...   [   58.773337] Freed by task 23683:   ...   [   58.774815]  kfree\u002B0xda/0x2b0   [   58.775038]  free_reloc_control\u002B0x1d6/0x220 [btrfs]   [   58.775465]  btrfs_relocate_block_group\u002B0x115c/0x1e20 [btrfs]   [   58.775944]  btrfs_relocate_chunk\u002B0xf1/0x760 [btrfs]   [   58.776369]  __btrfs_balance\u002B0x1326/0x1f10 [btrfs]   [   58.776784]  btrfs_balance\u002B0x3150/0x3d30 [btrfs]   [   58.777185]  btrfs_ioctl_balance\u002B0xd84/0x1410 [btrfs]   [   58.777621]  btrfs_ioctl\u002B0x4caa/0x114e0 [btrfs]   ...",
  "published": "2025-06-18T11:15:35Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00229,
  "epssPercentile": 0.13798,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.0.2-1",
      "fix": "DEBIAN-CVE-2022-50067",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50067",
      "released": "2025-06-18T11:15:35Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.0.2-1",
      "fix": "DEBIAN-CVE-2022-50067",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50067",
      "released": "2025-06-18T11:15:35Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.0.2-1",
      "fix": "DEBIAN-CVE-2022-50067",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50067",
      "released": "2025-06-18T11:15:35Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}