CVE-2022-50534

A metadata handling flaw was found in the Linux kernel device-mapper thin provisioning driver. After a failed metadata commit, the in-memory root pointer could reference a mixed set of fresh and stale tree nodes. Subsequent lookups may loop or stall.

A local user could use this flaw to cause the thin-pool worker to hang, resulting in a denial of service on the host.

If a transaction partially writes updated nodes and then fails, the pointer used for lookups may point into a broken tree. The correction reloads the last known good root at open time when a prior commit failed, so later reads do not traverse a corrupted path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module dm_thin_pool from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.