CVE-2022-49912: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49912 affects the Linux kernel's btrfs filesystem component, specifically involving memory leaks in the qgroup self tests. The vulnerability was published on May 1, 2025, and affects the testnosharedqgroup() and testmultiple_refs() functions (NVD, Wiz).

The vulnerability occurs in error handling paths where the 'oldroots' ulist, allocated by btrfsfindallroots(), is not properly freed when certain operations fail. This happens specifically when the tests fail to add tree references, remove extent items, or remove extent references. The CVSS v3.1 base score is 5.5 with attack vector being Local (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) (Red Hat).

The primary impact of this vulnerability is related to memory leaks in the kernel's btrfs filesystem testing components. While memory leaks can potentially lead to resource exhaustion over time, this particular issue is limited to the filesystem's self-test functionality (Wiz).

The vulnerability has been addressed by adding proper cleanup calls to ulist_free() before returning from the affected test functions. The fix ensures proper deallocation of memory resources in error paths. Several Linux distributions including Ubuntu and Debian have released fixes for affected versions (Wiz).