CVE-2022-50379: btrfs: fix race between quota enable and quota rescan ioctl

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-18 · updated 2026-06-17
Weakness: CWE-362

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between quota enable and quota rescan ioctl When enabling quotas, at btrfs_quota_enable(), after committing the transaction, we change fs_info->quota_root to point to the quota root we created and set BTRFS_FS_QUOTA_ENABLED at fs_info->flags. Then we try to start the qgroup rescan worker, first by initializing it with a call to qgroup_rescan_init() - however if that fails we end up freeing the quota root but we leave fs_info->quota_root still pointing to it, this can later result in a use-after-free somewhere else. We have previously set the flags BTRFS_FS_QUOTA_ENABLED and BTRFS_QGROUP_STATUS_FLAG_ON, so we can only fail with -EINPROGRESS at btrfs_quota_enable(), which is possible if someone already called the quota rescan ioctl, and therefore started the rescan worker. So fix this by ignoring an -EINPROGRESS and asserting we can't get any other error.

Affected products

Linux kernel: before 4.19.262; from 4.20 before 5.4.220; from 5.5 before 5.10.150; from 5.11 before 5.15.75; from 5.16 before 5.19.17; from 6.0 before 6.0.3 — fixed in 4.19.262, 5.10.150, 5.15.75, 5.19.17, 5.4.220, 6.0.3

How to fix

Upgrade to a fixed version: Linux kernel 4.19.262, 5.10.150, 5.15.75, 5.19.17. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-50379 or the next vulnerability affects your stack