{"schema_version":"1.9.0","id":"CVE-2022-50379","published":"2025-09-18T13:33:01.502Z","modified":"2026-08-12T03:51:23.239445891Z","related":["SUSE-SU-2025:03615-1","SUSE-SU-2025:03628-1","SUSE-SU-2025:3716-1","SUSE-SU-2025:3761-1"],"summary":"btrfs: fix race between quota enable and quota rescan ioctl","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix race between quota enable and quota rescan ioctl\n\nWhen enabling quotas, at btrfs_quota_enable(), after committing the\ntransaction, we change fs_info->quota_root to point to the quota root we\ncreated and set BTRFS_FS_QUOTA_ENABLED at fs_info->flags. Then we try\nto start the qgroup rescan worker, first by initializing it with a call\nto qgroup_rescan_init() - however if that fails we end up freeing the\nquota root but we leave fs_info->quota_root still pointing to it, this\ncan later result in a use-after-free somewhere else.\n\nWe have previously set the flags BTRFS_FS_QUOTA_ENABLED and\nBTRFS_QGROUP_STATUS_FLAG_ON, so we can only fail with -EINPROGRESS at\nbtrfs_quota_enable(), which is possible if someone already called the\nquota rescan ioctl, and therefore started the rescan worker.\n\nSo fix this by ignoring an -EINPROGRESS and asserting we can't get any\nother error.","affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5d23515be66904fa3b1b5d6bd72d2199cd2447ab"},{"fixed":"c97f6d528c3f1c83a6b792a8a7928c236c80b8fe"},{"fixed":"26b7c0ac49a3eea15559c9d84863736a6d1164b4"},{"fixed":"47b5ffe86332af95f0f52be0a63d4da7c2b37b55"},{"fixed":"4b996a3014ef014af8f97b60c35f5289210a4720"},{"fixed":"0efd9dfc00d677a1d0929319a6103cb2dfc41c22"},{"fixed":"6c22f86dd221eba0c7af645b1af73dcbc04ee27b"},{"fixed":"331cd9461412e103d07595a10289de90004ac890"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50379.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.17.0"},{"fixed":"4.19.262"}]},{"type":"ECOSYSTEM","events":[{"introduced":"4.20.0"},{"fixed":"5.4.220"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.10.150"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.75"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"5.19.17"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.20.0"},{"fixed":"6.0.3"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50379.json"}}],"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0efd9dfc00d677a1d0929319a6103cb2dfc41c22"},{"type":"WEB","url":"https://git.kernel.org/stable/c/26b7c0ac49a3eea15559c9d84863736a6d1164b4"},{"type":"WEB","url":"https://git.kernel.org/stable/c/331cd9461412e103d07595a10289de90004ac890"},{"type":"WEB","url":"https://git.kernel.org/stable/c/47b5ffe86332af95f0f52be0a63d4da7c2b37b55"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4b996a3014ef014af8f97b60c35f5289210a4720"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6c22f86dd221eba0c7af645b1af73dcbc04ee27b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c97f6d528c3f1c83a6b792a8a7928c236c80b8fe"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50379.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-50379"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50379.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}