Critical Btrfs Page Locking Vulnerability in Linux Kernel
Summary
CVE-2022-50089: In the Linux kernel, the following vulnerability has been resolved: btrfs: ensure pages are unlocked on cow_file_range() failure There is a hung_task report on zoned btrfs like below. Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware resources and providing essential services for software applications. It supports various file systems, including Btrfs, which is known for its advanced features like snapshots and dynamic inode allocation. This vulnerability specifically affects the Btrfs file system, which can lead to performance issues and system hangs under certain conditions.
Vulnerability Detail
The vulnerability, identified as CVE-2022-50089, arises from the cow_file_range() function in the Btrfs file system. When this function fails during allocation, it can leave certain pages locked, causing tasks to hang indefinitely. This issue is particularly problematic in zoned Btrfs configurations, where a hung task can block operations for extended periods, leading to system instability and degraded performance. The root cause is the failure to unlock pages in scenarios where allocation is only partially successful, which can occur due to insufficient space (e.g., -ENOSPC errors).
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the hung task timeout message by executing the command: 'echo 0 > /proc/sys/kernel/hung_task_timeout_secs'. However, this does not resolve the underlying issue and should only be used as a short-term measure.
Conclusion
CVE-2022-50089 is a significant vulnerability in the Linux kernel's Btrfs file system that can lead to system hangs and performance issues. Users are strongly advised to update their kernel to the patched version to mitigate the risks associated with this vulnerability. Temporary workarounds are available, but they do not address the root cause.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50089 is a vulnerability in the Linux kernel's Btrfs file system that can cause tasks to hang due to improperly managed page locks during allocation failures.
This vulnerability can lead to system hangs and performance degradation, particularly in environments using zoned Btrfs configurations.
If an immediate update is not possible, consider using the provided workaround to disable hung task timeout messages, but be aware that this does not fix the underlying issue.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Detailed information about CVE-2022-50089 can be found in the official CVE database and related security advisories.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
