{"cve":"CVE-2022-50766","nvd":{"published":"2025-12-24T13:16:03.400","modified":"2026-06-17T05:24:08.477","status":"Deferred","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: set generation before calling btrfs_clean_tree_block in btrfs_init_new_buffer\n\nsyzbot is reporting uninit-value in btrfs_clean_tree_block() [1], for\ncommit bc877d285ca3dba2 (\"btrfs: Deduplicate extent_buffer init code\")\nmissed that btrfs_set_header_generation() in btrfs_init_new_buffer() must\nnot be moved to after clean_tree_block() because clean_tree_block() is\ncalling btrfs_header_generation() since commit 55c69072d6bd5be1 (\"Btrfs:\nFix extent_buffer usage when nodesize != leafsize\").\n\nSince memzero_extent_buffer() will reset \"struct btrfs_header\" part, we\ncan't move btrfs_set_header_generation() to before memzero_extent_buffer().\nJust re-add btrfs_set_header_generation() before btrfs_clean_tree_block().","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/0a408c6212c16b9a2a1141d3c531247582ef8101","https://git.kernel.org/stable/c/89bc41c92d10b905c60f6ec13c9ef664a3555c54","https://git.kernel.org/stable/c/a687c2890fe4a2acaac6941fa4097a1264d8f3eb","https://git.kernel.org/stable/c/cbddcc4fa3443fe8cfb2ff8e210deb1f6a0eea38"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:18:08.089039631+00:00"},"epss":{"cve":"CVE-2022-50766","score":0.00238,"percentile":0.14862,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}