{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2022-49547 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2022-49547 is a medium-severity vulnerability in Linux kernel, published on 26 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-49547 and fix it if it is affected.\n\nWhat it is: CVE-2022-49547 is a medium-severity vulnerability in Linux kernel, published on 26 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2022-49547 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-49547/ (Markdown: https://insights.sbomify.com/CVE-2022-49547/index.md)","id":"CVE-2022-49547","markdown":"https://insights.sbomify.com/CVE-2022-49547/index.md","name":"CVE-2022-49547","record":{"aliases":["AZL-58347","DEBIAN-CVE-2022-49547","GHSA-85q7-hhcq-pr4h","ROOT-OS-UBUNTU-2204-CVE-2022-49547","UBUNTU-CVE-2022-49547"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel filesystem","requires_auth":"low_privilege","summary":"Concurrent direct IO writes can cause a deadlock in the Btrfs filesystem when free space is low, leading to a denial of service.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"cisa-adp","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-667","name":"Improper Locking"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix deadlock between concurrent dio writes when low on free data space\n\nWhen reserving data space for a direct IO write we can end up deadlocking\nif we have multiple tasks attempting a write to the same file range, there\nare multiple extents covered by that file range, we are low on available\nspace for data and the writes don't expand the inode's i_size.\n\nThe deadlock can happen like this:\n\n1) We have a file with an i_size of 1M, at offset 0 it has an extent with\n   a size of 128K and at offset 128K it has another extent also with a\n   size of 128K;\n\n2) Task A does a direct IO write against file range [0, 256K), and because\n   the write is within the i_size boundary, it takes the inode's lock (VFS\n   level) in shared mode;\n\n3) Task A locks the file range [0, 256K) at btrfs_dio_iomap_begin(), and\n   then gets the extent map for the extent covering the range [0, 128K).\n   At btrfs_get_blocks_direct_write(), it creates an ordered extent for\n   that file range ([0, 128K));\n\n4) Before returning from btrfs_dio_iomap_begin(), it unlocks the file\n   range [0, 256K);\n\n5) Task A executes btrfs_dio_iomap_begin() again, this time for the file\n   range [128K, 256K), and locks the file range [128K, 256K);\n\n6) Task B starts a direct IO write against file range [0, 256K) as well.\n   It also locks the inode in shared mode, as it's within the i_size limit,\n   and then tries to lock file range [0, 256K). It is able to lock the\n   subrange [0, 128K) but then blocks waiting for the range [128K, 256K),\n   as it is currently locked by task A;\n\n7) Task A enters btrfs_get_blocks_direct_write() and tries to reserve data\n   space. Because we are low on available free space, it triggers the\n   async data reclaim task, and waits for it to reserve data space;\n\n8) The async reclaim task decides to wait for all existing ordered extents\n   to complete (through btrfs_wait_ordered_roots()).\n   It finds the ordered extent previously created by task A for the file\n   range [0, 128K) and waits for it to complete;\n\n9) The ordered extent for the file range [0, 128K) can not complete\n   because it blocks at btrfs_finish_ordered_io() when trying to lock the\n   file range [0, 128K).\n\n   This results in a deadlock, because:\n\n   - task B is holding the file range [0, 128K) locked, waiting for the\n     range [128K, 256K) to be unlocked by task A;\n\n   - task A is holding the file range [128K, 256K) locked and it's waiting\n     for the async data reclaim task to satisfy its space reservation\n     request;\n\n   - the async data reclaim task is waiting for ordered extent [0, 128K)\n     to complete, but the ordered extent can not complete because the\n     file range [0, 128K) is currently locked by task B, which is waiting\n     on task A to unlock file range [128K, 256K) and task A waiting\n     on the async data reclaim task.\n\n   This results in a deadlock between 4 task: task A, task B, the async\n   data reclaim task and the task doing ordered extent completion (a work\n   queue task).\n\nThis type of deadlock can sporadically be triggered by the test case\ngeneric/300 from fstests, and results in a stack trace like the following:\n\n[12084.033689] INFO: task kworker/u16:7:123749 blocked for more than 241 seconds.\n[12084.034877]       Not tainted 5.18.0-rc2-btrfs-next-115 #1\n[12084.035562] \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n[12084.036548] task:kworker/u16:7   state:D stack:    0 pid:123749 ppid:     2 flags:0x00004000\n[12084.036554] Workqueue: btrfs-flush_delalloc btrfs_work_helper [btrfs]\n[12084.036599] Call Trace:\n[12084.036601]  \u003cTASK\u003e\n[12084.036606]  __schedule+0x3cb/0xed0\n[12084.036616]  schedule+0x4e/0xb0\n[12084.036620]  btrfs_start_ordered_extent+0x109/0x1c0 [btrfs]\n[12084.036651]  ? prepare_to_wait_exclusive+0xc0/0xc0\n[12084.036659]  btrfs_run_ordered_extent_work+0x1a/0x30 [btrfs]\n[12084.036688]  btrfs_work_helper+0xf8/0x400 [btrfs]\n[12084.0367\n---truncated---","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"btrfs: fix deadlock between concurrent dio writes when low on free data space","id":"CVE-2022-49547","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"race_condition","year":"2022"},"n_packages":0,"n_references":2,"next":{"headline":"bpf: Fix potential array overflow in bpf_trampoline_get_progs()","id":"CVE-2022-49548"},"packages":[],"prev":{"headline":"x86/kexec: fix memory leak of elf header buffer","id":"CVE-2022-49546"},"products":["Linux"],"published":"2025-02-26","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-05-23","vendors":["Linux"]},"summary":"Concurrent direct IO writes can cause a deadlock in the Btrfs filesystem when free space is low, leading to a denial of service.","url":"https://insights.sbomify.com/CVE-2022-49547/"}