Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2022-50841— fs/ntfs3: Add overflow check for attribute size

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于整数溢出，可能导致越界内存访问。

CVSS 7.8 · High EPSS 0.23% · P13 Updated Aug 05, 2026

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 10

Vendor	Product	Version Range	Status
Linux	Linux	`4342306f0f0d5ff4315a204d315c1b51b914fca5< d4489ba8fb806e07b43eecca5e9af5865d94cbf6`	affected
		`4342306f0f0d5ff4315a204d315c1b51b914fca5< a1f0b873cf6ac1f00a749707d866494ed0708978`	affected
		`4342306f0f0d5ff4315a204d315c1b51b914fca5< 0bb9f93ba63acfdb7c363d9f9fc2199fc6fa913d`	affected
		`4342306f0f0d5ff4315a204d315c1b51b914fca5< e19c6277652efba203af4ecd8eed4bd30a0054c9`	affected
		`5.15`	affected
		`< 5.15`	unaffected
		`5.15.87≤ 5.15.*`	unaffected
		`6.0.17≤ 6.0.*`	unaffected
… +2 more rows

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-50841

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

fs/ntfs3: Add overflow check for attribute size

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add overflow check for attribute size The offset addition could overflow and pass the used size check given an attribute with very large size (e.g., 0xffffff7f) while parsing MFT attributes. This could lead to out-of-bound memory R/W if we try to access the next attribute derived by Add2Ptr(attr, asize) [ 32.963847] BUG: unable to handle page fault for address: ffff956a83c76067 [ 32.964301] #PF: supervisor read access in kernel mode [ 32.964526] #PF: error_code(0x0000) - not-present page [ 32.964893] PGD 4dc01067 P4D 4dc01067 PUD 0 [ 32.965316] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 32.965727] CPU: 0 PID: 243 Comm: mount Not tainted 5.19.0+ #6 [ 32.966050] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 32.966628] RIP: 0010:mi_enum_attr+0x44/0x110 [ 32.967239] Code: 89 f0 48 29 c8 48 89 c1 39 c7 0f 86 94 00 00 00 8b 56 04 83 fa 17 0f 86 88 00 00 00 89 d0 01 ca 48 01 f0 8d 4a 08 39 f9a [ 32.968101] RSP: 0018:ffffba15c06a7c38 EFLAGS: 00000283 [ 32.968364] RAX: ffff956a83c76067 RBX: ffff956983c76050 RCX: 000000000000006f [ 32.968651] RDX: 0000000000000067 RSI: ffff956983c760e8 RDI: 00000000000001c8 [ 32.968963] RBP: ffffba15c06a7c38 R08: 0000000000000064 R09: 00000000ffffff7f [ 32.969249] R10: 0000000000000007 R11: ffff956983c760e8 R12: ffff95698225e000 [ 32.969870] R13: 0000000000000000 R14: ffffba15c06a7cd8 R15: ffff95698225e170 [ 32.970655] FS: 00007fdab8189e40(0000) GS:ffff9569fdc00000(0000) knlGS:0000000000000000 [ 32.971098] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.971378] CR2: ffff956a83c76067 CR3: 0000000002c58000 CR4: 00000000000006f0 [ 32.972098] Call Trace: [ 32.972842] <TASK> [ 32.973341] ni_enum_attr_ex+0xda/0xf0 [ 32.974087] ntfs_iget5+0x1db/0xde0 [ 32.974386] ? slab_post_alloc_hook+0x53/0x270 [ 32.974778] ? ntfs_fill_super+0x4c7/0x12a0 [ 32.975115] ntfs_fill_super+0x5d6/0x12a0 [ 32.975336] get_tree_bdev+0x175/0x270 [ 32.975709] ? put_ntfs+0x150/0x150 [ 32.975956] ntfs_fs_get_tree+0x15/0x20 [ 32.976191] vfs_get_tree+0x2a/0xc0 [ 32.976374] ? capable+0x19/0x20 [ 32.976572] path_mount+0x484/0xaa0 [ 32.977025] ? putname+0x57/0x70 [ 32.977380] do_mount+0x80/0xa0 [ 32.977555] __x64_sys_mount+0x8b/0xe0 [ 32.978105] do_syscall_64+0x3b/0x90 [ 32.978830] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 32.979311] RIP: 0033:0x7fdab72e948a [ 32.980015] Code: 48 8b 0d 11 fa 2a 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 008 [ 32.981251] RSP: 002b:00007ffd15b87588 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 32.981832] RAX: ffffffffffffffda RBX: 0000557de0aaf060 RCX: 00007fdab72e948a [ 32.982234] RDX: 0000557de0aaf260 RSI: 0000557de0aaf2e0 RDI: 0000557de0ab7ce0 [ 32.982714] RBP: 0000000000000000 R08: 0000557de0aaf280 R09: 0000000000000020 [ 32.983046] R10: 00000000c0ed0000 R11: 0000000000000206 R12: 0000557de0ab7ce0 [ 32.983494] R13: 0000557de0aaf260 R14: 0000000000000000 R15: 00000000ffffffff [ 32.984094] </TASK> [ 32.984352] Modules linked in: [ 32.984753] CR2: ffff956a83c76067 [ 32.985911] ---[ end trace 0000000000000000 ]--- [ 32.986555] RIP: 0010:mi_enum_attr+0x44/0x110 [ 32.987217] Code: 89 f0 48 29 c8 48 89 c1 39 c7 0f 86 94 00 00 00 8b 56 04 83 fa 17 0f 86 88 00 00 00 89 d0 01 ca 48 01 f0 8d 4a 08 39 f9a [ 32.988232] RSP: 0018:ffffba15c06a7c38 EFLAGS: 00000283 [ 32.988532] RAX: ffff956a83c76067 RBX: ffff956983c76050 RCX: 000000000000006f [ 32.988916] RDX: 0000000000000067 RSI: ffff956983c760e8 RDI: 00000000000001c8 [ 32.989356] RBP: ffffba15c06a7c38 R08: 0000000000000064 R09: 00000000ffffff7f [ 32.989994] R10: 0000000000000007 R11: ffff956983c760e8 R12: ffff95698225e000 [ 32.990415] R13: 0000000000000000 R14: ffffba15c06a7cd8 R15: ffff95698225e170 [ 32.991011] FS: ---truncated---

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Vulnerability Title

Linux kernel 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于整数溢出，可能导致越界内存访问。

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	4342306f0f0d5ff4315a204d315c1b51b914fca5 ~ d4489ba8fb806e07b43eecca5e9af5865d94cbf6	-
Linux	Linux	5.15	-

II. Public POCs for CVE-2022-50841

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2022-50841

请登录查看更多情报信息。

Other References for CVE-2022-50841 (4)

https://www.cve.org/CVERecord?id=CVE-2022-50841

Same Patch Batch · Linux · 2025-12-30 · 244 CVEs total

CVE-2023-54258	9.8 CRITICAL	cifs: fix potential oops in cifs_oplock_break
CVE-2023-54223	9.8 CRITICAL	net/mlx5e: xsk: Fix invalid buffer access for legacy rq
CVE-2023-54237	9.8 CRITICAL	net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link()
CVE-2023-54257	9.8 CRITICAL	net: macb: fix a memory corruption in extended buffer descriptor mode
CVE-2023-54269	9.8 CRITICAL	SUNRPC: double free xprt_ctxt while still in use
CVE-2023-54280	9.8 CRITICAL	cifs: fix potential race when tree connecting ipc
CVE-2023-54292	9.8 CRITICAL	RDMA/irdma: Fix data race on CQP request done
CVE-2023-54184	9.8 CRITICAL	scsi: target: iscsit: Free cmds before session free
CVE-2023-54203	9.1 CRITICAL	ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr
CVE-2022-50880	8.8 HIGH	wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
CVE-2023-54162	8.8 HIGH	ksmbd: fix possible memory leak in smb2_lock()
CVE-2023-54214	8.8 HIGH	Bluetooth: L2CAP: Fix potential user-after-free
CVE-2023-54318	8.8 HIGH	net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add
CVE-2023-54262	8.8 HIGH	net/mlx5e: Don't clone flow post action attributes second time
CVE-2023-54250	8.2 HIGH	ksmbd: avoid out of bounds access in decode_preauth_ctxt()
CVE-2023-54164	8.0 HIGH	Bluetooth: ISO: fix iso_conn related locking and validity issues
CVE-2023-54210	7.8 HIGH	Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()
CVE-2023-54201	7.8 HIGH	RDMA/efa: Fix wrong resources deallocation order
CVE-2023-54206	7.8 HIGH	net/sched: flower: fix filter idr initialization
CVE-2023-54216	7.8 HIGH	net/mlx5e: TC, Fix using eswitch mapping in nic mode

Showing top 20 of 244 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux

V. Comments for CVE-2022-50841

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2022-50841— fs/ntfs3: Add overflow check for attribute size

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 10

I. Basic Information for CVE-2022-50841

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2022-50841

III. Intelligence Information for CVE-2022-50841

Other References for CVE-2022-50841 (4)

Same Patch Batch · Linux · 2025-12-30 · 244 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2022-50841

Leave a comment