CVE-2022-50293

btrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range

Published Sep 15, 2025 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range

If we get -ENOMEM while dropping file extent items in a given range, at
btrfs_drop_extents(), due to failure to allocate memory when attempting to
increment the reference count for an extent or drop the reference count,
we handle it with a BUG_ON(). This is excessive, instead we can simply
abort the transaction and return the error to the caller. In fact most
callers of btrfs_drop_extents(), directly or indirectly, already abort
the transaction if btrfs_drop_extents() returns any error.

Also, we already have error paths at btrfs_drop_extents() that may return
-ENOMEM and in those cases we abort the transaction, like for example
anything that changes the b+tree may return -ENOMEM due to a failure to
allocate a new extent buffer when COWing an existing extent buffer, such
as a call to btrfs_duplicate_item() for example.

So replace the BUG_ON() calls with proper logic to abort the transaction
and return the error.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`39279cc3d2704cfbf9c35dcb5bdd392159ae4625`	affected	< 50f993da945074b2a069da099a0331b23a0c89a0
`39279cc3d2704cfbf9c35dcb5bdd392159ae4625`	affected	< 7fbcb635c8fc927d139f3302babcf1b42c09265c
`39279cc3d2704cfbf9c35dcb5bdd392159ae4625`	affected	< 1baf3370e2dc5e6bd1368348736189457dab2a27
`39279cc3d2704cfbf9c35dcb5bdd392159ae4625`	affected	< 162d053e15fe985f754ef495a96eb3db970c43ed

Linux

affected

Version	Status	Constraints
`2.6.29`	affected	—
`0`	unaffected	< 2.6.29
`5.15.86`	unaffected	≤ 5.15.*
`6.0.16`	unaffected	≤ 6.0.*
`6.1.2`	unaffected	≤ 6.1.*
`6.2`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor	Product	Versions
Linux	Linux Kernel	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2022-55562	In the Linux kernel, the following vulnerability has been resolved: btrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range If we get -ENOMEM while dropping file extent items in a given range, at btrfs_drop_extents(), due to failure to allocate memory when attempting to increment the reference count for an extent or drop the reference count, we handle it with a BUG_ON(). This is excessive, instead we can simply abort the transaction and return the error to the caller. In fact most callers of btrfs_drop_extents(), directly or indirectly, already abort the transaction if btrfs_drop_extents() returns any error. Also, we already have error paths at btrfs_drop_extents() that may return -ENOMEM and in those cases we abort the transaction, like for example anything that changes the b+tree may return -ENOMEM due to a failure to allocate a new extent buffer when COWing an existing extent buffer, such as a call to btrfs_duplicate_item() for example. So replace the BUG_ON() calls with proper logic to abort the transaction and return the error.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.159% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/162d053e15fe985f754ef495a96eb3db970c43ed
https://git.kernel.org/stable/c/1baf3370e2dc5e6bd1368348736189457dab2a27
https://git.kernel.org/stable/c/50f993da945074b2a069da099a0331b23a0c89a0
https://git.kernel.org/stable/c/7fbcb635c8fc927d139f3302babcf1b42c09265c
https://lore.kernel.org/linux-cve-announce/2025091556-CVE-2022-50293-2dbe@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2022-50293
https://www.cve.org/CVERecord?id=CVE-2022-50293

History

Dec 4, 2025 7:00 PM Weaknesses updated. Affected versions updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-617
CPEs		cpe:2.3:o:linux:linux_kernel::::::::

Sep 17, 2025 11:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Linux Linux linux Kernel
Vendors & Products		Linux Linux linux Kernel

Sep 16, 2025 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2025091556-CVE-2022-50293-2dbe@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2022-50293 https://www.cve.org/CVERecord?id=CVE-2022-50293
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Sep 15, 2025 3:00 PM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: btrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range If we get -ENOMEM while dropping file extent items in a given range, at btrfs_drop_extents(), due to failure to allocate memory when attempting to increment the reference count for an extent or drop the reference count, we handle it with a BUG_ON(). This is excessive, instead we can simply abort the transaction and return the error to the caller. In fact most callers of btrfs_drop_extents(), directly or indirectly, already abort the transaction if btrfs_drop_extents() returns any error. Also, we already have error paths at btrfs_drop_extents() that may return -ENOMEM and in those cases we abort the transaction, like for example anything that changes the b+tree may return -ENOMEM due to a failure to allocate a new extent buffer when COWing an existing extent buffer, such as a call to btrfs_duplicate_item() for example. So replace the BUG_ON() calls with proper logic to abort the transaction and return the error.
Title		btrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range
References		https://git.kernel.org/stable/c/162d053e15fe985f754ef495a96eb3db970c43ed https://git.kernel.org/stable/c/1baf3370e2dc5e6bd1368348736189457dab2a27 https://git.kernel.org/stable/c/50f993da945074b2a069da099a0331b23a0c89a0 https://git.kernel.org/stable/c/7fbcb635c8fc927d139f3302babcf1b42c09265c