CVE-2022-50755 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
udf: Avoid double brelse() in udf_rename()
syzbot reported a warning like below [1]:
VFS: brelse: Trying to free free buffer WARNING: CPU: 2 PID: 7301 at fs/buffer.c:1145 __brelse+0x67/0xa0 ... Call Trace: <TASK> invalidate_bh_lru+0x99/0x150 smp_call_function_many_cond+0xe2a/0x10c0 ? generic_remap_file_range_prep+0x50/0x50 ? __brelse+0xa0/0xa0 ? __mutex_lock+0x21c/0x12d0 ? smp_call_on_cpu+0x250/0x250 ? rcu_read_lock_sched_held+0xb/0x60 ? lock_release+0x587/0x810 ? __brelse+0xa0/0xa0 ? generic_remap_file_range_prep+0x50/0x50 on_each_cpu_cond_mask+0x3c/0x80 blkdev_flush_mapping+0x13a/0x2f0 blkdev_put_whole+0xd3/0xf0 blkdev_put+0x222/0x760 deactivate_locked_super+0x96/0x160 deactivate_super+0xda/0x100 cleanup_mnt+0x222/0x3d0 task_work_run+0x149/0x240 ? task_work_cancel+0x30/0x30 do_exit+0xb29/0x2a40 ? reacquire_held_locks+0x4a0/0x4a0 ? do_raw_spin_lock+0x12a/0x2b0 ? mm_update_next_owner+0x7c0/0x7c0 ? rwlock_bug.part.0+0x90/0x90 ? zap_other_threads+0x234/0x2d0 do_group_exit+0xd0/0x2a0 __x64_sys_exit_group+0x3a/0x50 do_syscall_64+0x34/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd
The cause of the issue is that brelse() is called on both ofibh.sbh and ofibh.ebh by udf_find_entry() when it returns NULL. However, brelse() is called by udf_rename(), too. So, b_count on buffer_head becomes unbalanced.
This patch fixes the issue by not calling brelse() by udf_rename() when udf_find_entry() returns NULL.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/21/2026
The vulnerability identified as CVE-2022-50755 represents a critical buffer management flaw within the Linux kernel's Universal Disk Format (UDF) implementation. This issue manifests as a double brelse() operation during the udf_rename() function execution, creating a scenario where buffer head structures are released twice, leading to memory corruption and system instability. The vulnerability was discovered through automated fuzzing by syzbot, which detected a warning message indicating that the kernel was attempting to free an already freed buffer. This type of double-free condition falls under the category of improper handling of buffer resources, which is classified as CWE-415 in the Common Weakness Enumeration framework.
The technical root cause of this vulnerability lies in the improper synchronization of buffer head release operations within the UDF filesystem code. When udf_find_entry() function returns NULL, it attempts to release both ofibh.sbh and ofibh.ebh buffer heads through brelse() calls, but the udf_rename() function subsequently calls brelse() on the same buffer heads. This results in an unbalanced buffer count where the reference counter for the buffer_head structure becomes corrupted, potentially leading to memory allocation errors and system crashes. The call trace reveals the complex chain of kernel functions involved, including invalidate_bh_lru, smp_call_function_many_cond, and various buffer management routines that ultimately lead to the double release condition. This issue demonstrates a classic example of improper resource management where the same memory object is freed multiple times without proper reference counting mechanisms.
The operational impact of this vulnerability extends beyond simple system crashes, as it can potentially be exploited to cause denial of service conditions or even facilitate more sophisticated attacks. When the buffer management becomes corrupted, the kernel's ability to properly manage filesystem metadata and data structures is compromised, potentially leading to data loss or filesystem corruption. The vulnerability affects systems running Linux kernels with UDF filesystem support, particularly those that perform frequent filesystem rename operations or handle UDF formatted storage devices. From an adversarial perspective, this vulnerability aligns with ATT&CK technique T1490, which involves creating or manipulating files to disrupt system operations, and could potentially be leveraged in a broader attack chain targeting system stability and availability.
The patch addressing this vulnerability implements a straightforward but critical fix by preventing udf_rename() from calling brelse() on buffer heads when udf_find_entry() returns NULL. This ensures that buffer head release operations occur only once, maintaining proper reference counting and preventing the double-free condition. The solution aligns with secure coding practices for buffer management and demonstrates the importance of careful resource handling in kernel space operations. System administrators should prioritize applying this patch to all affected Linux systems, particularly those handling UDF filesystems or performing frequent filesystem operations. The vulnerability highlights the necessity of thorough testing and validation of filesystem operations, especially in kernel space where improper resource management can have cascading effects throughout the entire system. Organizations should also consider implementing monitoring for buffer-related warnings and system instability indicators that may precede or accompany such vulnerabilities.