CVE-2022-49913 is a vulnerability identified in the Linux kernel's Btrfs filesystem implementation, specifically within the function find_parent_nodes() used during back reference (backref) walking. The vulnerability arises when handling data extents and encountering errors while resolving indirect back references in resolve_indirect_refs() or iterating over direct references stored in a red-black tree (rbtree). In such error scenarios, inode lists attached to certain direct references are leaked because they are not properly freed. This occurs because these inode lists have not yet been added to the refs ulist argument passed to find_parent_nodes(), and the prelim_release() function, which is responsible for freeing resources, does not free inode lists attached to refs not added to the ulist. Consequently, memory allocated for these inode lists remains unreleased, causing a memory leak. The fix involves modifying prelim_release() to always free any attached inode list for each ref found in the rbtree and updating find_parent_nodes() to set the ref's inode list pointer to NULL once ownership is transferred to a ref added to the refs ulist. This ensures proper memory management and prevents leaks during error handling in backref walking. The vulnerability affects Linux kernel versions identified by the commit hash 86d5f994425252d8a40e2184c94a2682ae8ecfbf and was published on May 1, 2025. There are no known exploits in the wild, and no CVSS score has been assigned to this vulnerability as of the publication date.

The primary impact of CVE-2022-49913 is a memory leak within the Linux kernel's Btrfs filesystem code during specific error conditions. For European organizations relying on Linux systems with Btrfs filesystems, this could lead to gradual memory exhaustion on affected systems, potentially causing degraded performance, system instability, or crashes if the leak accumulates over time. While this vulnerability does not directly allow for privilege escalation, code execution, or data corruption, the memory leak could be exploited in a denial-of-service (DoS) scenario by triggering the error conditions repeatedly to exhaust system memory. This is particularly relevant for servers, storage appliances, or critical infrastructure running Linux with Btrfs, which are common in European data centers and enterprises. The impact is more pronounced in environments with high filesystem activity or where error conditions in backref walking are more likely to occur. However, since no known exploits exist and exploitation requires triggering specific error paths, the immediate risk is moderate. Still, unpatched systems may face reliability issues over time, affecting availability and operational continuity.

To mitigate CVE-2022-49913, European organizations should prioritize updating their Linux kernel to versions that include the patch fixing this vulnerability. Since the issue is related to memory management in the Btrfs filesystem code, applying the official kernel update that modifies prelim_release() and find_parent_nodes() functions is essential. Organizations should: 1) Identify all Linux systems using Btrfs filesystems, especially those running kernel versions prior to the patch commit (86d5f994425252d8a40e2184c94a2682ae8ecfbf). 2) Schedule and deploy kernel updates from trusted Linux distributions or directly from the Linux kernel source that address this vulnerability. 3) Monitor system memory usage on Btrfs systems for unusual leaks or degradation, particularly under workloads involving heavy filesystem operations. 4) Implement proactive system health checks and automated alerts for memory anomalies to detect potential exploitation attempts or system instability early. 5) For critical systems where immediate patching is not feasible, consider temporarily switching to alternative filesystems or isolating affected systems to limit exposure. 6) Maintain robust backup and recovery procedures to mitigate potential availability impacts. These steps go beyond generic advice by focusing on filesystem-specific identification, targeted patching, and operational monitoring tailored to the nature of this vulnerability.