Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2022-49914
CVE-2022-49914:
Linux Kernel vulnerability analysis and mitigation
Overview
CVE-2022-49914 is a vulnerability discovered in the Linux kernel affecting the btrfs filesystem component. The issue was disclosed on May 1, 2025, and involves an inode list leak during backref walking at resolveindirectrefs() function (NVD).
Technical details
The vulnerability occurs during backref walking at resolveindirectrefs(), where if an error is encountered, the code jumps to the 'out' label and calls ulist_free() on the 'parents' ulist. While this frees all elements in the ulist, it fails to free any inode lists that may be attached to elements through the 'aux' field of a ulist node, resulting in memory leaks (NVD). The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Red Hat).
Impact
The vulnerability results in memory leaks in the Linux kernel when certain operations are performed on btrfs filesystems. This can lead to resource exhaustion over time if repeatedly triggered (NVD).
Mitigation and workarounds
The issue has been fixed by replacing the ulistfree() call with freeleaflist() when exiting from resolveindirectrefs(). The static function freeleaf_list() was moved up to make this possible and was simplified by removing unnecessary code (NVD).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management