Critical Vulnerability in Linux Kernel: BTRFS Metadata Reservation Issue
Summary
CVE-2022-50090: In the Linux kernel, the following vulnerability has been resolved: btrfs: replace BTRFS_MAX_EXTENT_SIZE with fs_info->max_extent_size On zoned filesystem, data write out is limited by max_zone_append_size, and a large o... Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. BTRFS (B-tree file system) is a modern file system for Linux that offers advanced features such as snapshots, dynamic inode allocation, and built-in RAID capabilities. However, it is susceptible to vulnerabilities that can affect its performance and reliability, particularly in zoned file systems.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the BTRFS file system related to the handling of metadata reservations. The issue arises when the maximum extent size (BTRFS_MAX_EXTENT_SIZE) exceeds the maximum zone append size (max_zone_append_size) on zoned file systems. This can lead to a situation where the number of extents to be written increases significantly, causing the reserved metadata to run out. This results in warnings and potential system instability, especially in environments with limited RAM and disabled metadata over-commit.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can monitor their system's memory usage and adjust the configuration of the BTRFS file system to prevent excessive metadata reservations. However, the best solution is to apply the patch as soon as it is available.
Conclusion
The vulnerability in the Linux kernel's BTRFS file system poses significant risks, particularly in zoned file systems with limited memory. Users are strongly advised to update to the patched version to mitigate these risks and ensure system stability.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system warnings and potential crashes due to insufficient metadata reservations, particularly in low-memory environments.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
If an immediate update is not possible, consider adjusting your BTRFS configuration to manage metadata reservations more effectively.
This vulnerability affects the Linux kernel across various distributions, particularly those using BTRFS as their file system.
Detailed information can be found in the CVE database and through the Linux kernel mailing lists where patches and discussions are shared.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
