In the Linux kernel, the following vulnerability has been resolved: btrfs: fix inode list leak during backref walking at resolve_indirect_refs() During backref walking, at resolve_indirect_refs(), if we get an error we jump to the 'out' label and call ulist_free() on the 'parents' ulist, which frees all the elements in the ulist - however that does not free any inode lists that may be attached to elements, through the 'aux' field of a ulist node, so we end up leaking lists if we have any attached to the unodes. Fix this by calling free_leaf_list() instead of ulist_free() when we exit from resolve_indirect_refs(). The static function free_leaf_list() is moved up for this to be possible and it's slightly simplified by removing unnecessary code.
2025-05-01T15:16:16.593
2025-11-12T16:06:57.320
Analyzed
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSSv3.1: 5.5 (MEDIUM)
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Operating System | linux | linux_kernel | < 4.14.299 | Yes |
| Operating System | linux | linux_kernel | < 4.19.265 | Yes |
| Operating System | linux | linux_kernel | < 5.4.224 | Yes |
| Operating System | linux | linux_kernel | < 5.10.154 | Yes |
| Operating System | linux | linux_kernel | < 5.15.78 | Yes |
| Operating System | linux | linux_kernel | < 6.0.8 | Yes |
| Operating System | linux | linux_kernel | 6.1 | Yes |
| Operating System | linux | linux_kernel | 6.1 | Yes |
| Operating System | linux | linux_kernel | 6.1 | Yes |