CVE-2022-49850 is a concurrency vulnerability in the Linux kernel's NILFS2 (New Implementation of a Log-structured File System) subsystem. The issue arises from a semaphore deadlock involving two read-write semaphores (rwsem A and rwsem B) used to protect metadata structures during file operations and superblock writebacks. Specifically, when nilfs_get_block() detects metadata corruption during block location, it holds a read lock on rwsem A and calls nilfs_bmap_lookup_contig(). If corruption is detected, __nilfs_error() is invoked, which calls nilfs_set_error() to write-lock rwsem B for superblock writeback. This creates a lock acquisition order of rwsem A followed by rwsem B. Concurrently, another task performing superblock updates may acquire a write lock on rwsem B first and then attempt to read-lock rwsem A in nilfs_count_free_blocks(), causing a circular wait and deadlock. The root cause is that nilfs_count_free_blocks() unnecessarily acquires rwsem A while only reading a single integer shared with nilfs_sufile_get_ncleansegs(), which does not require locking. The fix removes the acquisition of rwsem A in nilfs_count_free_blocks(), thus preventing the deadlock by eliminating the lock order inversion. This vulnerability affects Linux kernel versions containing the specified commit hashes and is relevant to systems using the NILFS2 filesystem. No known exploits are reported in the wild, and no CVSS score has been assigned yet.

For European organizations, the impact of CVE-2022-49850 primarily concerns systems running Linux with NILFS2 filesystems, which are less common than ext4 or XFS but may be used in specialized environments requiring log-structured filesystems for high-performance or fault-tolerant storage. The deadlock can cause system hangs or unresponsiveness during file operations or superblock updates, potentially leading to denial of service (DoS) conditions. This can disrupt critical services, especially in data centers, cloud infrastructure, or embedded systems relying on Linux. Although this vulnerability does not directly lead to privilege escalation or data corruption, the availability impact can affect business continuity and operational stability. European organizations with Linux-based infrastructure should assess their use of NILFS2 and consider the risk of deadlocks causing system outages. Since no known exploits exist, the threat is moderate but warrants timely patching to avoid potential service disruptions.

1. Apply the official Linux kernel patch that removes the unnecessary semaphore acquisition in nilfs_count_free_blocks() as soon as it becomes available in your distribution's kernel updates. 2. Identify and inventory systems using NILFS2 filesystems; if NILFS2 is not in use, the risk is negligible. 3. For critical systems where immediate patching is not feasible, consider temporarily avoiding workloads that trigger heavy metadata operations or superblock writebacks on NILFS2 volumes. 4. Implement monitoring for kernel deadlocks or system hangs related to NILFS2 operations to detect potential exploitation or manifestation of this issue. 5. Engage with Linux distribution vendors to confirm patch availability and backport status for long-term support kernels commonly used in European enterprise environments. 6. Review system logs for nilfs-related errors or warnings that may indicate corruption or deadlock conditions and proactively remediate filesystem issues.