CVE-2022-49879

ext4: fix BUG_ON() when directory entry has invalid rec_len

MEDIUM

5.5

CVSS Score

Published: May 1, 2025 at 02:10 PM UTC

Updated: June 17, 2026 at 05:19 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: ext4: fix BUG_ON() when directory entry has invalid rec_len The rec_len field in the directory entry has to be a multiple of 4. A corrupted filesystem image can be used to hit a BUG() in ext4_rec_len_to_disk(), called from make_indexed_dir(). ------------[ cut here ]------------ kernel BUG at fs/ext4/ext4.h:2413! ... RIP: 0010:make_indexed_dir+0x53f/0x5f0 ... Call Trace: <TASK> ? add_dirent_to_buf+0x1b2/0x200 ext4_add_entry+0x36e/0x480 ext4_add_nondir+0x2b/0xc0 ext4_create+0x163/0x200 path_openat+0x635/0xe90 do_filp_open+0xb4/0x160 ? __create_object.isra.0+0x1de/0x3b0 ? _raw_spin_unlock+0x12/0x30 do_sys_openat2+0x91/0x150 __x64_sys_open+0x6c/0xa0 do_syscall_64+0x3c/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The fix simply adds a call to ext4_check_dir_entry() to validate the directory entry, returning -EFSCORRUPTED if the entry is invalid.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

v < 5.4.2242.6.30 ≤ v < 5.10.1542.6.30 ≤ v < 5.15.782.6.30 ≤ v < 5.4.2242.6.30 ≤ v < 6.0.82.6.30 ≤ v < 6.15.11 ≤ v < 5.15.785.16 ≤ v < 6.0.85.5 ≤ v < 5.10.1542.6.303d0518f4758eca4339e75e5b9dbb7e06a5ce08b46.1 rc1 6.1 rc2 6.1 rc3

Vendor states this is fixed in 156451a67b93986fb07c274ef6995ff40766c5ad (fixed)

Vendor states this is fixed in 17a0bc9bd697f75cfdf9b378d5eb2d7409c91340 (fixed)

Vendor states this is fixed in 2fa24d0274fbf913b56ee31f15bc01168669d909 (fixed)

Vendor states this is fixed in 999cff2b6ce3b45c08abf793bf55534777421327 (fixed)

Vendor states this is fixed in ce1ee2c8827fb6493e91acbd50f664cf2a972c3d (fixed)

Vendor states this is fixed in 2.6.30 (unaffected)

Vendor states this is fixed in 5.10.154 (unaffected)

Vendor states this is fixed in 5.15.78 (unaffected)

Vendor states this is fixed in 5.4.224 (unaffected)

Vendor states this is fixed in 6.0.8 (unaffected)

Vendor states this is fixed in 6.1 (unaffected)