Skip to content
OpenAdvisories
Unscored CVE-2022-49914 EUVD-2025-12867GHSA-jgm3-v9g7-rfc3

btrfs: fix inode list leak during backref walking at resolve_indirect_refs()

Published May 1, 2025 · Updated May 11, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.15 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.4 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-fips Package: linux-aws-hwe Package: linux-azure Package: linux-azure-4.15 Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.15 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.4 Package: linux-azure-5.8 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-azure-fips Package: linux-bluefield Package: linux-fips Package: linux-gcp Package: linux-gcp-4.15 Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.15 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.4 Package: linux-gcp-5.8 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-fips Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.15 Package: linux-hwe-5.19 Package: linux-hwe-5.4 Package: linux-hwe-5.8 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-edge Package: linux-ibm Package: linux-ibm-5.4 Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-intel-iotg Package: linux-intel-iotg-5.15 Package: linux-iot Package: linux-kvm Package: linux-lowlatency Package: linux-lowlatency-hwe-5.15 Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-lts-xenial Package: linux-nvidia Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.5 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.15 Package: linux-oracle-5.3 Package: linux-oracle-5.4 Package: linux-oracle-5.8 Package: linux-oracle-6.5 Package: linux-raspi Package: linux-raspi-5.4 Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.15 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.5 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-vmware Package: linux-xilinx-zynqmp Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix inode list leak during backref walking at resolve_indirect_refs()

During backref walking, at resolve_indirect_refs(), if we get an error
we jump to the 'out' label and call ulist_free() on the 'parents' ulist,
which frees all the elements in the ulist - however that does not free
any inode lists that may be attached to elements, through the 'aux' field
of a ulist node, so we end up leaking lists if we have any attached to
the unodes.

Fix this by calling free_leaf_list() instead of ulist_free() when we exit
from resolve_indirect_refs(). The static function free_leaf_list() is
moved up for this to be possible and it's slightly simplified by removing
unnecessary code.

Affected products

VendorProductAffectedFixed
Linux Linux 3.5 4.14.299

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 6.0.8-1 —
Debian 13 linux 6.0.8-1 —
Debian 12 linux 6.0.8-1 —
ReleasePackageFixed inAdvisory
Ubuntu Nvidia-BlueField 22.04 LTS linux-bluefield 5.15.0-1014.16 —
Ubuntu 24.04 LTS linux-realtime +1 No fix yet —
Ubuntu 22.04 LTS linux +1 5.15.0-60.66 —
Ubuntu 22.04 LTS linux-aws 5.15.0-1030.34 —
Ubuntu 22.04 LTS linux-azure 5.15.0-1033.40 —
Ubuntu 22.04 LTS linux-azure-fde 5.15.0-1033.40.1 —
Ubuntu 22.04 LTS linux-gcp 5.15.0-1029.36 —
Ubuntu 22.04 LTS linux-gke 5.15.0-1027.32 —
Ubuntu 22.04 LTS linux-gkeop 5.15.0-1015.19 —
Ubuntu 22.04 LTS linux-ibm 5.15.0-1025.28 —
Ubuntu 22.04 LTS linux-intel-iotg 5.15.0-1025.30 —
Ubuntu 22.04 LTS linux-kvm 5.15.0-1028.33 —
Ubuntu 22.04 LTS linux-nvidia 5.15.0-1017.17 —
Ubuntu 22.04 LTS linux-oracle 5.15.0-1029.35 —
Ubuntu 22.04 LTS linux-raspi 5.15.0-1024.26 —
Ubuntu 22.04 LTS linux-riscv +32 No fix yet —
Ubuntu 20.04 LTS linux 5.4.0-139.156 —
Ubuntu 20.04 LTS linux-aws 5.4.0-1096.104 —
Ubuntu 20.04 LTS linux-aws-5.15 5.15.0-1030.34~20.04.1 —
Ubuntu 20.04 LTS linux-azure 5.4.0-1103.109 —
Ubuntu 20.04 LTS linux-azure-5.15 5.15.0-1033.40~20.04.1 —
Ubuntu 20.04 LTS linux-bluefield 5.4.0-1058.64 —
Ubuntu 20.04 LTS linux-gcp 5.4.0-1100.109 —
Ubuntu 20.04 LTS linux-gcp-5.15 5.15.0-1029.36~20.04.1 —
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Ubuntu 20.04 LTS linux-hwe-5.15 +1 5.15.0-60.66~20.04.1 —
Ubuntu 20.04 LTS linux-ibm 5.4.0-1044.49 —
Ubuntu 20.04 LTS linux-intel-iotg-5.15 5.15.0-1025.30~20.04.1 —
Ubuntu 20.04 LTS linux-iot 5.4.0-1012.14 —
Ubuntu 20.04 LTS linux-kvm 5.4.0-1086.92 —
Ubuntu 20.04 LTS linux-oracle 5.4.0-1093.102 —
Ubuntu 20.04 LTS linux-oracle-5.15 5.15.0-1029.35~20.04.1 —
Ubuntu 20.04 LTS linux-raspi 5.4.0-1080.91 —
Ubuntu 20.04 LTS linux-riscv-5.15 5.15.0-1029.33~20.04.1 —
Ubuntu 20.04 LTS linux-xilinx-zynqmp 5.4.0-1021.25 —
Ubuntu 18.04 LTS linux 4.15.0-206.217 —
Ubuntu 18.04 LTS linux-aws 4.15.0-1151.164 —
Ubuntu 18.04 LTS linux-aws-5.4 5.4.0-1096.104~18.04.1 —
Ubuntu 18.04 LTS linux-azure-4.15 4.15.0-1162.177 —
Ubuntu 18.04 LTS linux-azure-5.4 5.4.0-1103.109~18.04.1 —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 18.04 LTS linux-gcp-4.15 4.15.0-1146.162 —
Ubuntu 18.04 LTS linux-gcp-5.4 5.4.0-1100.109~18.04.1 —
Ubuntu 18.04 LTS linux-hwe-5.4 5.4.0-139.156~18.04.1 —
Ubuntu 18.04 LTS linux-ibm-5.4 5.4.0-1044.49~18.04.1 —
Ubuntu 18.04 LTS linux-kvm 4.15.0-1136.141 —
Ubuntu 18.04 LTS linux-oracle 4.15.0-1115.126 —
Ubuntu 18.04 LTS linux-oracle-5.4 5.4.0-1093.102~18.04.1 —
Ubuntu 18.04 LTS linux-raspi-5.4 5.4.0-1080.91~18.04.1 —
Show 9 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Ubuntu Pro FIPS 20.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS 18.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS 16.04 LTS linux-fips No fix yet —
Ubuntu Pro FIPS-updates 20.04 LTS linux-aws-fips 5.4.0-1096.104+fips1 —
Ubuntu Pro FIPS-updates 20.04 LTS linux-azure-fips 5.4.0-1103.109+fips1 —
Ubuntu Pro FIPS-updates 20.04 LTS linux-fips 5.4.0-1072.81 —
Ubuntu Pro FIPS-updates 20.04 LTS linux-gcp-fips 5.4.0-1100.109+fips1 —
Ubuntu Pro FIPS-updates 18.04 LTS linux-aws-fips 4.15.0-2090.96 —
Ubuntu Pro FIPS-updates 18.04 LTS linux-azure-fips 4.15.0-2071.77 —
Ubuntu Pro FIPS-updates 18.04 LTS linux-fips 4.15.0-1108.119 —
Ubuntu Pro FIPS-updates 18.04 LTS linux-gcp-fips 4.15.0-2055.60 —
Ubuntu Pro FIPS-updates 16.04 LTS linux-fips No fix yet —
Ubuntu Pro 16.04 LTS linux +2 No fix yet —
Ubuntu Pro 16.04 LTS linux-aws-hwe 4.15.0-1151.164~16.04.1 —
Ubuntu Pro 16.04 LTS linux-azure 4.15.0-1162.177~16.04.1 —
Ubuntu Pro 16.04 LTS linux-gcp 4.15.0-1146.162~16.04.1 —
Ubuntu Pro 16.04 LTS linux-hwe 4.15.0-206.217~16.04.1 —
Ubuntu Pro 16.04 LTS linux-oracle 4.15.0-1115.126~16.04.1 —
Ubuntu Pro 14.04 LTS linux +2 No fix yet —
Ubuntu Pro 14.04 LTS linux-azure 4.15.0-1162.177~14.04.1 —
ReleasePackageFixed inAdvisory
SLES 12 SP5 kernel-syms +2 4.12.14-122.261.1 SUSE-SU-2025:01983-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Live Patching 12 SP5 kernel-default 4.12.14-122.261.1 SUSE-SU-2025:01983-1
SLE Live Patching 12 SP5 kgraft-patch-SLE12-SP5_Update_69 1-8.3.1 SUSE-SU-2025:01983-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 kernel-livepatch-4.14.299-223.520 1.0-0.amzn2 ALAS2-2022-1888
Amazon Linux 2 perf +8 4.14.299-223.520.amzn2 ALAS2-2022-1888

Advisories 2

References