CVE-2022-50021

ext4: block range must be validated before use in ext4_mb_clear_bb()

HIGH

7.8

CVSS Score

Published: June 18, 2025 at 11:01 AM UTC

Updated: June 17, 2026 at 05:22 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: ext4: block range must be validated before use in ext4_mb_clear_bb() Block range to free is validated in ext4_free_blocks() using ext4_inode_block_valid() and then it's passed to ext4_mb_clear_bb(). However in some situations on bigalloc file system the range might be adjusted after the validation in ext4_free_blocks() which can lead to troubles on corrupted file systems such as one found by syzkaller that resulted in the following BUG kernel BUG at fs/ext4/ext4.h:3319! PREEMPT SMP NOPTI CPU: 28 PID: 4243 Comm: repro Kdump: loaded Not tainted 5.19.0-rc6+ #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1.fc35 04/01/2014 RIP: 0010:ext4_free_blocks+0x95e/0xa90 Call Trace: <TASK> ? lock_timer_base+0x61/0x80 ? __es_remove_extent+0x5a/0x760 ? __mod_timer+0x256/0x380 ? ext4_ind_truncate_ensure_credits+0x90/0x220 ext4_clear_blocks+0x107/0x1b0 ext4_free_data+0x15b/0x170 ext4_ind_truncate+0x214/0x2c0 ? _raw_spin_unlock+0x15/0x30 ? ext4_discard_preallocations+0x15a/0x410 ? ext4_journal_check_start+0xe/0x90 ? __ext4_journal_start_sb+0x2f/0x110 ext4_truncate+0x1b5/0x460 ? __ext4_journal_start_sb+0x2f/0x110 ext4_evict_inode+0x2b4/0x6f0 evict+0xd0/0x1d0 ext4_enable_quotas+0x11f/0x1f0 ext4_orphan_cleanup+0x3de/0x430 ? proc_create_seq_private+0x43/0x50 ext4_fill_super+0x295f/0x3ae0 ? snprintf+0x39/0x40 ? sget_fc+0x19c/0x330 ? ext4_reconfigure+0x850/0x850 get_tree_bdev+0x16d/0x260 vfs_get_tree+0x25/0xb0 path_mount+0x431/0xa70 __x64_sys_mount+0xe2/0x120 do_syscall_64+0x5b/0x80 ? do_user_addr_fault+0x1e2/0x670 ? exc_page_fault+0x70/0x170 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7fdf4e512ace Fix it by making sure that the block range is properly validated before used every time it changes in ext4_free_blocks() or ext4_mb_clear_bb().

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

v < 5.10.1753.2 ≤ v < 5.10.1753.2 ≤ v < 5.15.1033.2 ≤ v < 5.19.43.2 ≤ v < 6.05.11 ≤ v < 5.15.1035.16 ≤ v < 5.19.43.284130193e0e6568dfdfb823f0e1e19aec80aff6e

Vendor states this is fixed in 1e1c2b86ef86a8477fd9b9a4f48a6bfe235606f6 (fixed)

Vendor states this is fixed in 560a2744cbbf03cac65a6394f9b0d99aa437c867 (fixed)

Vendor states this is fixed in 7550aade978371ac582f6d43b14c4cb89ca54463 (fixed)

Vendor states this is fixed in a2522041d248a8c969cbbc97e1fc2cd8b4de120d (fixed)

Vendor states this is fixed in 3.2 (unaffected)

Vendor states this is fixed in 5.10.175 (unaffected)

Vendor states this is fixed in 5.15.103 (unaffected)

Vendor states this is fixed in 5.19.4 (unaffected)

Vendor states this is fixed in 6.0 (unaffected)