CVE-2022-50835

What it actually does

Missing buffer head release after use in fc_do_one_pass() within jbd2 causes a reference count leak on affected Linux kernel builds.

Why it matters to the business

Prolonged operation on unpatched systems can exhaust kernel resources, degrading stability and availability of Linux workloads with high journaling activity.

How an attack unfolds

An attacker with local code execution triggers repeated journal fast-commit operations that invoke fc_do_one_pass() without the missing release, gradually leaking buffer-head references until resource limits are reached.

How to fix it

Apply the listed fixed versions: wireshark packages on Debian 11-14 updated to 2.6.5-1; Linux kernel trees updated to commit e65506ff181fc176088f32117d69b9cb1ddda777. Reboot after kernel updates.

How to confirm the fix worked

Confirm kernel source contains the buffer-head release after the fc_do_one_pass() call; run regression tests exercising fast-commit journaling and monitor /proc/slabinfo or kmemleak for leaks.

Typical attack path

1. Gain local shell or user-level execution on target Linux system
2. Exercise filesystem operations that invoke jbd2 fast-commit paths
3. Repeat triggering of fc_do_one_pass() to accumulate reference-count leaks
4. Monitor for kernel memory pressure or OOM conditions

How to detect it

Examine kernel logs for repeated jbd2 fast-commit warnings or slab allocation growth; correlate with processes performing heavy filesystem journaling; no public exploit artifacts are known.

What your security team should do

• Prioritize patching Linux kernel packages on all production systems within the next maintenance window
• Verify fixed commit is present in custom or downstream kernel builds
• Add kernel resource-usage monitoring to detect anomalous buffer-head growth
• Review and test fast-commit journaling workloads after upgrade