CVE-2022-50766 btrfs: set generation before calling btrfs_clean_tree_block in btrfs_init_new_buffer
A local attacker can read uninitialized kernel memory via a race condition in the Btrfs filesystem, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50766?
CVE-2022-50766 is a vulnerability in Linux, published on 24 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
btrfs: set generation before calling btrfs_clean_tree_block in btrfs_init_new_buffer
syzbot is reporting uninit-value in btrfs_clean_tree_block() [1], for commit bc877d285ca3dba2 ("btrfs: Deduplicate extent_buffer init code") missed that btrfs_set_header_generation() in btrfs_init_new_buffer() must not be moved to after clean_tree_block() because clean_tree_block() is calling btrfs_header_generation() since commit 55c69072d6bd5be1 ("Btrfs: Fix extent_buffer usage when nodesize != leafsize").
Since memzero_extent_buffer() will reset "struct btrfs_header" part, we can't move btrfs_set_header_generation() to before memzero_extent_buffer(). Just re-add btrfs_set_header_generation() before btrfs_clean_tree_block().
Which versions are affected by CVE-2022-50766?
How do I fix CVE-2022-50766?
Apply the vendor's patch.
Is CVE-2022-50766 being exploited?
There is no known exploitation of CVE-2022-50766 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2022-50766, GHSA-65xq-q38h-gcrc, ROOT-OS-DEBIAN-11-CVE-2022-50766, UBUNTU-CVE-2022-50766.