CVE-2025-22019

What it actually does

Incorrect dcache pruning in bch2_evict_subvolume_inodes() causes the function to hang, combined with missing permission checks in bch2_ioctl_subvolume_destroy() that allow unauthorized subvolume destruction operations.

Why it matters to the business

Systems using bcachefs may experience filesystem operation hangs or allow unprivileged users to destroy subvolumes, leading to potential data loss, service disruption, and compliance issues on affected Linux kernels; low exploitation likelihood reduces immediate risk despite the 560-day exposure window.

How an attack unfolds

An attacker with local access triggers a race condition during subvolume destruction by concurrently accessing inodes while the kernel incorrectly prunes the dcache, or bypasses the absent permission checks to destroy subvolumes without authorization; no named threat actors or ransomware campaigns are associated.

How to fix it

Update to a fixed kernel containing commit 9e6e83e1e2d01b99e70cd7812d7f758a8def9fc8 or apply the corresponding SUSE package versions such as 1.4.17-3.11.2 for listed modules; rebuild and reboot systems after patching.

How to confirm the fix worked

Confirm the running kernel includes commit 9e6e83e1e2d01b99e70cd7812d7f758a8def9fc8 via uname or source inspection; test subvolume destruction requires proper permissions and completes without hangs under concurrent load.

Typical attack path

1. Obtain local unprivileged access on a system running an affected bcachefs-enabled kernel
2. Invoke bch2_ioctl_subvolume_destroy() while racing inode eviction operations
3. Exploit missing permission validation to destroy target subvolumes or induce hangs via dcache pruning errors

How to detect it

Review kernel logs for bcachefs hang traces involving evict_subvolume_inodes or dcache operations; inspect audit logs for unexpected subvolume destruction calls lacking proper credentials; no ransomware-specific artifacts apply.

What your security team should do

• Prioritize kernel updates on all bcachefs deployments within standard patch cycles given low EPSS and absence from KEV
• Audit local access controls around filesystem ioctl interfaces until patches are applied
• Monitor for bcachefs-related hangs in production workloads as an operational indicator