{"id":"DEBIAN-CVE-2022-50067","details":"In the Linux kernel, the following vulnerability has been resolved:  btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()  In btrfs_relocate_block_group(), the rc is allocated.  Then btrfs_relocate_block_group() calls  relocate_block_group()   prepare_to_relocate()     set_reloc_control()  that assigns rc to the variable fs_info-\u003ereloc_ctl. When prepare_to_relocate() returns, it calls  btrfs_commit_transaction()   btrfs_start_dirty_block_groups()     btrfs_alloc_path()       kmem_cache_zalloc()  which may fail for example (or other errors could happen). When the failure occurs, btrfs_relocate_block_group() detects the error and frees rc and doesn't set fs_info-\u003ereloc_ctl to NULL. After that, in btrfs_init_reloc_root(), rc is retrieved from fs_info-\u003ereloc_ctl and then used, which may cause a use-after-free bug.  This possible bug can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag().  To fix this possible bug, in prepare_to_relocate(), check if btrfs_commit_transaction() fails. If the failure occurs, unset_reloc_control() is called to set fs_info-\u003ereloc_ctl to NULL.  The error log in our fault-injection testing is shown as follows:    [   58.751070] BUG: KASAN: use-after-free in btrfs_init_reloc_root+0x7ca/0x920 [btrfs]   ...   [   58.753577] Call Trace:   ...   [   58.755800]  kasan_report+0x45/0x60   [   58.756066]  btrfs_init_reloc_root+0x7ca/0x920 [btrfs]   [   58.757304]  record_root_in_trans+0x792/0xa10 [btrfs]   [   58.757748]  btrfs_record_root_in_trans+0x463/0x4f0 [btrfs]   [   58.758231]  start_transaction+0x896/0x2950 [btrfs]   [   58.758661]  btrfs_defrag_root+0x250/0xc00 [btrfs]   [   58.759083]  btrfs_ioctl_defrag+0x467/0xa00 [btrfs]   [   58.759513]  btrfs_ioctl+0x3c95/0x114e0 [btrfs]   ...   [   58.768510] Allocated by task 23683:   [   58.768777]  ____kasan_kmalloc+0xb5/0xf0   [   58.769069]  __kmalloc+0x227/0x3d0   [   58.769325]  alloc_reloc_control+0x10a/0x3d0 [btrfs]   [   58.769755]  btrfs_relocate_block_group+0x7aa/0x1e20 [btrfs]   [   58.770228]  btrfs_relocate_chunk+0xf1/0x760 [btrfs]   [   58.770655]  __btrfs_balance+0x1326/0x1f10 [btrfs]   [   58.771071]  btrfs_balance+0x3150/0x3d30 [btrfs]   [   58.771472]  btrfs_ioctl_balance+0xd84/0x1410 [btrfs]   [   58.771902]  btrfs_ioctl+0x4caa/0x114e0 [btrfs]   ...   [   58.773337] Freed by task 23683:   ...   [   58.774815]  kfree+0xda/0x2b0   [   58.775038]  free_reloc_control+0x1d6/0x220 [btrfs]   [   58.775465]  btrfs_relocate_block_group+0x115c/0x1e20 [btrfs]   [   58.775944]  btrfs_relocate_chunk+0xf1/0x760 [btrfs]   [   58.776369]  __btrfs_balance+0x1326/0x1f10 [btrfs]   [   58.776784]  btrfs_balance+0x3150/0x3d30 [btrfs]   [   58.777185]  btrfs_ioctl_balance+0xd84/0x1410 [btrfs]   [   58.777621]  btrfs_ioctl+0x4caa/0x114e0 [btrfs]   ...","modified":"2026-09-01T16:05:34.370775992Z","published":"2025-06-18T11:15:35.490Z","upstream":["CVE-2022-50067"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2022-50067"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50067.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50067.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50067.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}