{
  "cveId": "CVE-2022-50089",
  "url": "https://patchblox.com/security/cve/CVE-2022-50089",
  "summary": "CVE-2022-50089 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-50089, released June 18, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  btrfs: ensure pages are unlocked on cow_file_ran...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  btrfs: ensure pages are unlocked on cow_file_range() failure  There is a hung_task report on zoned btrfs like below.  https://github.com/naota/linux/issues/59    [726.328648] INFO: task rocksdb:high0:11085 blocked for more than 241 seconds.   [726.329839]       Not tainted 5.16.0-rc1\u002B #1   [726.330484] \u0022echo 0 \u003E /proc/sys/kernel/hung_task_timeout_secs\u0022 disables this message.   [726.331603] task:rocksdb:high0   state:D stack:    0 pid:11085 ppid: 11082 flags:0x00000000   [726.331608] Call Trace:   [726.331611]  \u003CTASK\u003E   [726.331614]  __schedule\u002B0x2e5/0x9d0   [726.331622]  schedule\u002B0x58/0xd0   [726.331626]  io_schedule\u002B0x3f/0x70   [726.331629]  __folio_lock\u002B0x125/0x200   [726.331634]  ? find_get_entries\u002B0x1bc/0x240   [726.331638]  ? filemap_invalidate_unlock_two\u002B0x40/0x40   [726.331642]  truncate_inode_pages_range\u002B0x5b2/0x770   [726.331649]  truncate_inode_pages_final\u002B0x44/0x50   [726.331653]  btrfs_evict_inode\u002B0x67/0x480   [726.331658]  evict\u002B0xd0/0x180   [726.331661]  iput\u002B0x13f/0x200   [726.331664]  do_unlinkat\u002B0x1c0/0x2b0   [726.331668]  __x64_sys_unlink\u002B0x23/0x30   [726.331670]  do_syscall_64\u002B0x3b/0xc0   [726.331674]  entry_SYSCALL_64_after_hwframe\u002B0x44/0xae   [726.331677] RIP: 0033:0x7fb9490a171b   [726.331681] RSP: 002b:00007fb943ffac68 EFLAGS: 00000246 ORIG_RAX: 0000000000000057   [726.331684] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb9490a171b   [726.331686] RDX: 00007fb943ffb040 RSI: 000055a6bbe6ec20 RDI: 00007fb94400d300   [726.331687] RBP: 00007fb943ffad00 R08: 0000000000000000 R09: 0000000000000000   [726.331688] R10: 0000000000000031 R11: 0000000000000246 R12: 00007fb943ffb000   [726.331690] R13: 00007fb943ffb040 R14: 0000000000000000 R15: 00007fb943ffd260   [726.331693]  \u003C/TASK\u003E  While we debug the issue, we found running fstests generic/551 on 5GB non-zoned null_blk device in the emulated zoned mode also had a similar hung issue.  Also, we can reproduce the same symptom with an error injected cow_file_range() setup.  The hang occurs when cow_file_range() fails in the middle of allocation. cow_file_range() called from do_allocation_zoned() can split the give region ([start, end]) for allocation depending on current block group usages. When btrfs can allocate bytes for one part of the split regions but fails for the other region (e.g. because of -ENOSPC), we return the error leaving the pages in the succeeded regions locked. Technically, this occurs only when @unlock == 0. Otherwise, we unlock the pages in an allocated region after creating an ordered extent.  Considering the callers of cow_file_range(unlock=0) won\u0027t write out the pages, we can unlock the pages on error exit from cow_file_range(). So, we can ensure all the pages except @locked_page are unlocked on error case.  In summary, cow_file_range now behaves like this:  - page_started == 1 (return value)   - All the pages are unlocked. IO is started. - unlock == 1   - All the pages except @locked_page are unlocked in any case - unlock == 0   - On success, all the pages are locked for writing out them   - On failure, all the pages except @locked_page are unlocked",
  "published": "2025-06-18T11:15:38Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00193,
  "epssPercentile": 0.09023,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.0.2-1",
      "fix": "DEBIAN-CVE-2022-50089",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50089",
      "released": "2025-06-18T11:15:38Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.0.2-1",
      "fix": "DEBIAN-CVE-2022-50089",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50089",
      "released": "2025-06-18T11:15:38Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.0.2-1",
      "fix": "DEBIAN-CVE-2022-50089",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50089",
      "released": "2025-06-18T11:15:38Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}