CVE-2022-50766: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50766 is a vulnerability in the Linux kernel's Btrfs filesystem subsystem involving an uninitialized value read in btrfs_clean_tree_block(). The root cause is a code ordering regression introduced by commit bc877d285ca3dba2 ("btrfs: Deduplicate extent_buffer init code"), which incorrectly moved btrfs_set_header_generation() to after btrfs_clean_tree_block(), causing the latter to read an uninitialized generation field. The vulnerability was publicly disclosed on December 24, 2025, and affects Linux kernel versions from commit bc877d285ca3dba2 up to the respective fix commits across stable branches. It carries an estimated CVSS severity of Medium and an EPSS score of approximately 0.018% (Feedly, EUVD).

The vulnerability is classified as an uninitialized value use (CWE-457) within the Btrfs btrfs_init_new_buffer() function in the Linux kernel. When a new extent buffer is initialized, memzero_extent_buffer() zeroes out the btrfs_header structure, and the subsequent call to btrfs_clean_tree_block() reads the header's generation field via btrfs_header_generation() before it has been set — resulting in an uninit-value read as reported by syzbot. The fix re-adds the btrfs_set_header_generation() call immediately before btrfs_clean_tree_block() to ensure the generation field is populated before it is accessed. Patch commits are available across multiple stable branches: 0a408c6212c1 (5.19.x), a687c2890fe4 (5.15.x), 89bc41c92d10 (6.0.x), and cbddcc4fa344 (6.1.x) (Feedly, EUVD).

Exploitation of this vulnerability could lead to undefined kernel behavior due to the use of an uninitialized memory value in the Btrfs tree block management path. In practice, this may result in kernel instability, unexpected filesystem behavior, or system crashes (denial of service) on systems using the Btrfs filesystem. There is no known direct path to privilege escalation or data exfiltration from this specific bug, making the primary impact one of availability (Feedly, EUVD).

The Linux kernel maintainers have released fixes across multiple stable branches. Users should update to kernel versions containing the following fix commits: cbddcc4fa344 (6.1 branch), 0a408c6212c1 (5.19.17+), a687c2890fe4 (5.15.75+), and 89bc41c92d10 (6.0.3+). Distributions such as Amazon Linux 2 (kernel 5.15) have issued advisories incorporating this fix (e.g., ALAS2KERNEL-5.15-2025-090). Administrators running Btrfs filesystems on affected kernel versions should prioritize applying the relevant stable kernel update for their distribution (Feedly, Amazon Linux Advisory).