CVE-2022-50546— ext4: fix uninititialized value in 'ext4_evict_inode'
Possible ATT&CK Techniques 2AI
T1190 · Exploit Public-Facing Application T1203 · Exploitation for Client ExecutionAffected Version Matrix 20
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | bb337d8dd1e1d6b7719872e45e36392f3ab14b4f< f0bffdcc7cb14598af2aa706f1e0f2a9054154ba | affected |
a5f9bd4beae8553480d02b569d4aabee1b49345d< e431b4fb1fb8c2654b808086e9747a000adb9655 | affected | ||
0e6fbc566fcc4c230bf80f76cf5df26b42142d8a< 091f85db4c3fb1734a6d7fb4777a2b2831da6631 | affected | ||
0b885394fd009aa0b46d81b496a816ab11309f8a< 3c31d8d3ad95aef8cc17a4fcf317e46217148439 | affected | ||
6bc0d63dad7f9f54d381925ee855b402f652fa39< 56491d60ddca9c697d885394cb0173675b9ab81f | affected | ||
6bc0d63dad7f9f54d381925ee855b402f652fa39< 9f966e021c20caae639dd0e404c8761e8281a2c4 | affected | ||
6bc0d63dad7f9f54d381925ee855b402f652fa39< 7ea71af94eaaaf6d9aed24bc94a05b977a741cb9 | affected | ||
819d16f7feaca0f2ed3409be14fe953127fc51b6 | affected | ||
| … +12 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2022-50546
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ext4: fix uninititialized value in 'ext4_evict_inode'
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ext4: fix uninititialized value in 'ext4_evict_inode' Syzbot found the following issue: ===================================================== BUG: KMSAN: uninit-value in ext4_evict_inode+0xdd/0x26b0 fs/ext4/inode.c:180 ext4_evict_inode+0xdd/0x26b0 fs/ext4/inode.c:180 evict+0x365/0x9a0 fs/inode.c:664 iput_final fs/inode.c:1747 [inline] iput+0x985/0xdd0 fs/inode.c:1773 __ext4_new_inode+0xe54/0x7ec0 fs/ext4/ialloc.c:1361 ext4_mknod+0x376/0x840 fs/ext4/namei.c:2844 vfs_mknod+0x79d/0x830 fs/namei.c:3914 do_mknodat+0x47d/0xaa0 __do_sys_mknodat fs/namei.c:3992 [inline] __se_sys_mknodat fs/namei.c:3989 [inline] __ia32_sys_mknodat+0xeb/0x150 fs/namei.c:3989 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82 Uninit was created at: __alloc_pages+0x9f1/0xe80 mm/page_alloc.c:5578 alloc_pages+0xaae/0xd80 mm/mempolicy.c:2285 alloc_slab_page mm/slub.c:1794 [inline] allocate_slab+0x1b5/0x1010 mm/slub.c:1939 new_slab mm/slub.c:1992 [inline] ___slab_alloc+0x10c3/0x2d60 mm/slub.c:3180 __slab_alloc mm/slub.c:3279 [inline] slab_alloc_node mm/slub.c:3364 [inline] slab_alloc mm/slub.c:3406 [inline] __kmem_cache_alloc_lru mm/slub.c:3413 [inline] kmem_cache_alloc_lru+0x6f3/0xb30 mm/slub.c:3429 alloc_inode_sb include/linux/fs.h:3117 [inline] ext4_alloc_inode+0x5f/0x860 fs/ext4/super.c:1321 alloc_inode+0x83/0x440 fs/inode.c:259 new_inode_pseudo fs/inode.c:1018 [inline] new_inode+0x3b/0x430 fs/inode.c:1046 __ext4_new_inode+0x2a7/0x7ec0 fs/ext4/ialloc.c:959 ext4_mkdir+0x4d5/0x1560 fs/ext4/namei.c:2992 vfs_mkdir+0x62a/0x870 fs/namei.c:4035 do_mkdirat+0x466/0x7b0 fs/namei.c:4060 __do_sys_mkdirat fs/namei.c:4075 [inline] __se_sys_mkdirat fs/namei.c:4073 [inline] __ia32_sys_mkdirat+0xc4/0x120 fs/namei.c:4073 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82 CPU: 1 PID: 4625 Comm: syz-executor.2 Not tainted 6.1.0-rc4-syzkaller-62821-gcb231e2f67ec #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 ===================================================== Now, 'ext4_alloc_inode()' didn't init 'ei->i_flags'. If new inode failed before set 'ei->i_flags' in '__ext4_new_inode()', then do 'iput()'. As after 6bc0d63dad7f commit will access 'ei->i_flags' in 'ext4_evict_inode()' which will lead to access uninit-value. To solve above issue just init 'ei->i_flags' in 'ext4_alloc_inode()'.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于ext4_evict_inode函数中存在未初始化值，可能导致内存损坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2022-50546
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-50546
请登录查看更多情报信息。
Patches & Fixes for CVE-2022-50546 (7)
Same Patch Batch · Linux · 2025-10-07 · 118 CVEs total
| CVE-2023-53629 | 9.8 CRITICAL | fs: dlm: fix use after free in midcomms commit |
| CVE-2023-53630 | 8.8 HIGH | iommufd: Fix unpinning of pages when an access is present |
| CVE-2023-53676 | 8.8 HIGH | scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() |
| CVE-2023-53675 | 8.8 HIGH | scsi: ses: Fix possible desc_ptr out-of-bounds accesses |
| CVE-2023-53673 | 8.8 HIGH | Bluetooth: hci_event: call disconnect callback before deleting conn |
| CVE-2023-53679 | 8.3 HIGH | wifi: mt7601u: fix an integer underflow |
| CVE-2023-53635 | 8.2 HIGH | netfilter: conntrack: fix wrong ct->timeout value |
| CVE-2022-50555 | 7.8 HIGH | tipc: fix a null-ptr-deref in tipc_topsrv_accept |
| CVE-2023-53659 | 7.8 HIGH | iavf: Fix out-of-bounds when setting channels on remove |
| CVE-2023-53619 | 7.8 HIGH | netfilter: conntrack: Avoid nf_ct_helper_hash uses after free |
| CVE-2023-53660 | 7.8 HIGH | bpf, cpumap: Handle skb as well when clean up ptr_ring |
| CVE-2023-53643 | 7.8 HIGH | nvme-tcp: don't access released socket during error recovery |
| CVE-2023-53645 | 7.8 HIGH | bpf: Make bpf_refcount_acquire fallible for non-owning refs |
| CVE-2023-53646 | 7.8 HIGH | drm/i915/perf: add sentinel to xehp_oa_b_counters |
| CVE-2023-53669 | 7.8 HIGH | tcp: fix skb_copy_ubufs() vs BIG TCP |
| CVE-2023-53626 | 7.8 HIGH | ext4: fix possible double unlock when moving a directory |
| CVE-2023-53627 | 7.8 HIGH | scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list |
| CVE-2022-50528 | 7.8 HIGH | drm/amdkfd: Fix memory leakage |
| CVE-2023-53683 | 7.8 HIGH | fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() |
| CVE-2022-50518 | 7.8 HIGH | parisc: Fix locking in pdc_iodc_print() firmware call |
Showing top 20 of 118 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-74579
netfilter: nft_payload: fix mask build for partial field off - CVE-2026-74578
crypto: algif_skcipher - force synchronous processing on tre - CVE-2026-74577
net: mpls: initialize rtm_tos in mpls_getroute() - CVE-2026-74576
mm/slab: prevent unbounded recursion in free path with new k - CVE-2026-74574
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev
Same vendor: Linux
- CVE-2026-74579
netfilter: nft_payload: fix mask build for partial field off - CVE-2026-74578
crypto: algif_skcipher - force synchronous processing on tre - CVE-2026-74577
net: mpls: initialize rtm_tos in mpls_getroute() - CVE-2026-74576
mm/slab: prevent unbounded recursion in free path with new k - CVE-2026-74574
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev
V. Comments for CVE-2022-50546
No comments yet