{"id":"CVE-2022-50346","state":"PUBLISHED","title":"ext4: init quota for 'old.inode' in 'ext4_rename'","description":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: init quota for 'old.inode' in 'ext4_rename'\n\nSyzbot found the following issue:\next4_parse_param: s_want_extra_isize=128\next4_inode_info_init: s_want_extra_isize=32\next4_rename: old.inode=ffff88823869a2c8 old.dir=ffff888238699828 new.inode=ffff88823869d7e8 new.dir=ffff888238699828\n__ext4_mark_inode_dirty: inode=ffff888238699828 ea_isize=32 want_ea_size=128\n__ext4_mark_inode_dirty: inode=ffff88823869a2c8 ea_isize=32 want_ea_size=128\next4_xattr_block_set: inode=ffff88823869a2c8\n------------[ cut here ]------------\nWARNING: CPU: 13 PID: 2234 at fs/ext4/xattr.c:2070 ext4_xattr_block_set.cold+0x22/0x980\nModules linked in:\nRIP: 0010:ext4_xattr_block_set.cold+0x22/0x980\nRSP: 0018:ffff888227d3f3b0 EFLAGS: 00010202\nRAX: 0000000000000001 RBX: ffff88823007a000 RCX: 0000000000000000\nRDX: 0000000000000a03 RSI: 0000000000000040 RDI: ffff888230078178\nRBP: 0000000000000000 R08: 000000000000002c R09: ffffed1075c7df8e\nR10: ffff8883ae3efc6b R11: ffffed1075c7df8d R12: 0000000000000000\nR13: ffff88823869a2c8 R14: ffff8881012e0460 R15: dffffc0000000000\nFS:  00007f350ac1f740(0000) GS:ffff8883ae200000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f350a6ed6a0 CR3: 0000000237456000 CR4: 00000000000006e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n ? ext4_xattr_set_entry+0x3b7/0x2320\n ? ext4_xattr_block_set+0x0/0x2020\n ? ext4_xattr_set_entry+0x0/0x2320\n ? ext4_xattr_check_entries+0x77/0x310\n ? ext4_xattr_ibody_set+0x23b/0x340\n ext4_xattr_move_to_block+0x594/0x720\n ext4_expand_extra_isize_ea+0x59a/0x10f0\n __ext4_expand_extra_isize+0x278/0x3f0\n __ext4_mark_inode_dirty.cold+0x347/0x410\n ext4_rename+0xed3/0x174f\n vfs_rename+0x13a7/0x2510\n do_renameat2+0x55d/0x920\n __x64_sys_rename+0x7d/0xb0\n do_syscall_64+0x3b/0xa0\n entry_SYSCALL_64_after_hwframe+0x72/0xdc\n\nAs 'ext4_rename' will modify 'old.inode' ctime and mark inode dirty,\nwhich may trigger expand 'extra_isize' and allocate block. If inode\ndidn't init quota will lead to warning.  To solve above issue, init\n'old.inode' firstly in 'ext4_rename'.","publishedAt":"2025-09-16T16:11:39.179Z","updatedAt":"2026-05-11T19:17:45.342Z","severity":{"score":5.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"CISA-ADP"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"6dd4ee7cab7e3a17c571aebd444f4344c8c4946e","status":"affected","lessThan":"67f6d5a4043f3db0c6bb0e14a0d97a7be8bfb8b5","versionType":"git"},{"version":"6dd4ee7cab7e3a17c571aebd444f4344c8c4946e","status":"affected","lessThan":"33fd7031d634f3b46e59f61adfbb0ea9fe514fef","versionType":"git"},{"version":"6dd4ee7cab7e3a17c571aebd444f4344c8c4946e","status":"affected","lessThan":"7dfb8259f66faafa68d23a261b284d2c2c67649b","versionType":"git"},{"version":"6dd4ee7cab7e3a17c571aebd444f4344c8c4946e","status":"affected","lessThan":"f263e349bacc2f303526dcfa61c4bc50132418b1","versionType":"git"},{"version":"6dd4ee7cab7e3a17c571aebd444f4344c8c4946e","status":"affected","lessThan":"84a2f2ed49d6a4d92b354219077434c57d334620","versionType":"git"},{"version":"6dd4ee7cab7e3a17c571aebd444f4344c8c4946e","status":"affected","lessThan":"def7a39091e60e1c4a2f623629082a00092602be","versionType":"git"},{"version":"6dd4ee7cab7e3a17c571aebd444f4344c8c4946e","status":"affected","lessThan":"135ba9146f4d38abed48a540ef8a8770ff0bd34f","versionType":"git"},{"version":"6dd4ee7cab7e3a17c571aebd444f4344c8c4946e","status":"affected","lessThan":"13271fbbe85d73a7c47058f56a52f2a7f00d6e39","versionType":"git"},{"version":"6dd4ee7cab7e3a17c571aebd444f4344c8c4946e","status":"affected","lessThan":"fae381a3d79bb94aa2eb752170d47458d778b797","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ext4/namei.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.23","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.23","versionType":"semver"},{"version":"4.9.337","status":"unaffected","lessThanOrEqual":"4.9.*","versionType":"semver"},{"version":"4.14.303","status":"unaffected","lessThanOrEqual":"4.14.*","versionType":"semver"},{"version":"4.19.270","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.229","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.163","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.87","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.0.18","status":"unaffected","lessThanOrEqual":"6.0.*","versionType":"semver"},{"version":"6.1.4","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ext4/namei.c"]}],"references":["https://git.kernel.org/stable/c/67f6d5a4043f3db0c6bb0e14a0d97a7be8bfb8b5","https://git.kernel.org/stable/c/33fd7031d634f3b46e59f61adfbb0ea9fe514fef","https://git.kernel.org/stable/c/7dfb8259f66faafa68d23a261b284d2c2c67649b","https://git.kernel.org/stable/c/f263e349bacc2f303526dcfa61c4bc50132418b1","https://git.kernel.org/stable/c/84a2f2ed49d6a4d92b354219077434c57d334620","https://git.kernel.org/stable/c/def7a39091e60e1c4a2f623629082a00092602be","https://git.kernel.org/stable/c/135ba9146f4d38abed48a540ef8a8770ff0bd34f","https://git.kernel.org/stable/c/13271fbbe85d73a7c47058f56a52f2a7f00d6e39","https://git.kernel.org/stable/c/fae381a3d79bb94aa2eb752170d47458d778b797"],"weaknesses":["CWE-908"],"ingestedAt":"2026-10-29T20:05:26.763Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/50xxx/CVE-2022-50346.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-50346","state":"PUBLISHED","datePublished":"2025-09-16T16:11:39.179Z","dateUpdated":"2026-05-11T19:17:45.342Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-09-16T16:03:27.882Z"},"containers":{"cna":{"title":"ext4: init quota for 'old.inode' in 'ext4_rename'","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: init quota for 'old.inode' in 'ext4_rename'\n\nSyzbot found the following issue:\next4_parse_param: s_want_extra_isize=128\next4_inode_info_init: s_want_extra_isize=32\next4_rename: old.inode=ffff88823869a2c8 old.dir=ffff888238699828 new.inode=ffff88823869d7e8 new.dir=ffff888238699828\n__ext4_mark_inode_dirty: inode=ffff888238699828 ea_isize=32 want_ea_size=128\n__ext4_mark_inode_dirty: inode=ffff88823869a2c8 ea_isize=32 want_ea_size=128\next4_xattr_block_set: inode=ffff88823869a2c8\n------------[ cut here ]------------\nWARNING: CPU: 13 PID: 2234 at fs/ext4/xattr.c:2070 ext4_xattr_block_set.cold+0x22/0x980\nModules linked in:\nRIP: 0010:ext4_xattr_block_set.cold+0x22/0x980\nRSP: 0018:ffff888227d3f3b0 EFLAGS: 00010202\nRAX: 0000000000000001 RBX: ffff88823007a000 RCX: 0000000000000000\nRDX: 0000000000000a03 RSI: 0000000000000040 RDI: ffff888230078178\nRBP: 0000000000000000 R08: 000000000000002c R09: ffffed1075c7df8e\nR10: ffff8883ae3efc6b R11: ffffed1075c7df8d R12: 0000000000000000\nR13: ffff88823869a2c8 R14: ffff8881012e0460 R15: dffffc0000000000\nFS:  00007f350ac1f740(0000) GS:ffff8883ae200000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f350a6ed6a0 CR3: 0000000237456000 CR4: 00000000000006e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n ? ext4_xattr_set_entry+0x3b7/0x2320\n ? ext4_xattr_block_set+0x0/0x2020\n ? ext4_xattr_set_entry+0x0/0x2320\n ? ext4_xattr_check_entries+0x77/0x310\n ? ext4_xattr_ibody_set+0x23b/0x340\n ext4_xattr_move_to_block+0x594/0x720\n ext4_expand_extra_isize_ea+0x59a/0x10f0\n __ext4_expand_extra_isize+0x278/0x3f0\n __ext4_mark_inode_dirty.cold+0x347/0x410\n ext4_rename+0xed3/0x174f\n vfs_rename+0x13a7/0x2510\n do_renameat2+0x55d/0x920\n __x64_sys_rename+0x7d/0xb0\n do_syscall_64+0x3b/0xa0\n entry_SYSCALL_64_after_hwframe+0x72/0xdc\n\nAs 'ext4_rename' will modify 'old.inode' ctime and mark inode dirty,\nwhich may trigger expand 'extra_isize' and allocate block. If inode\ndidn't init quota will lead to warning.  To solve above issue, init\n'old.inode' firstly in 'ext4_rename'."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"6dd4ee7cab7e3a17c571aebd444f4344c8c4946e","status":"affected","lessThan":"67f6d5a4043f3db0c6bb0e14a0d97a7be8bfb8b5","versionType":"git"},{"version":"6dd4ee7cab7e3a17c571aebd444f4344c8c4946e","status":"affected","lessThan":"33fd7031d634f3b46e59f61adfbb0ea9fe514fef","versionType":"git"},{"version":"6dd4ee7cab7e3a17c571aebd444f4344c8c4946e","status":"affected","lessThan":"7dfb8259f66faafa68d23a261b284d2c2c67649b","versionType":"git"},{"version":"6dd4ee7cab7e3a17c571aebd444f4344c8c4946e","status":"affected","lessThan":"f263e349bacc2f303526dcfa61c4bc50132418b1","versionType":"git"},{"version":"6dd4ee7cab7e3a17c571aebd444f4344c8c4946e","status":"affected","lessThan":"84a2f2ed49d6a4d92b354219077434c57d334620","versionType":"git"},{"version":"6dd4ee7cab7e3a17c571aebd444f4344c8c4946e","status":"affected","lessThan":"def7a39091e60e1c4a2f623629082a00092602be","versionType":"git"},{"version":"6dd4ee7cab7e3a17c571aebd444f4344c8c4946e","status":"affected","lessThan":"135ba9146f4d38abed48a540ef8a8770ff0bd34f","versionType":"git"},{"version":"6dd4ee7cab7e3a17c571aebd444f4344c8c4946e","status":"affected","lessThan":"13271fbbe85d73a7c47058f56a52f2a7f00d6e39","versionType":"git"},{"version":"6dd4ee7cab7e3a17c571aebd444f4344c8c4946e","status":"affected","lessThan":"fae381a3d79bb94aa2eb752170d47458d778b797","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ext4/namei.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.23","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.23","versionType":"semver"},{"version":"4.9.337","status":"unaffected","lessThanOrEqual":"4.9.*","versionType":"semver"},{"version":"4.14.303","status":"unaffected","lessThanOrEqual":"4.14.*","versionType":"semver"},{"version":"4.19.270","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.229","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.163","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.87","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.0.18","status":"unaffected","lessThanOrEqual":"6.0.*","versionType":"semver"},{"version":"6.1.4","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ext4/namei.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/67f6d5a4043f3db0c6bb0e14a0d97a7be8bfb8b5"},{"url":"https://git.kernel.org/stable/c/33fd7031d634f3b46e59f61adfbb0ea9fe514fef"},{"url":"https://git.kernel.org/stable/c/7dfb8259f66faafa68d23a261b284d2c2c67649b"},{"url":"https://git.kernel.org/stable/c/f263e349bacc2f303526dcfa61c4bc50132418b1"},{"url":"https://git.kernel.org/stable/c/84a2f2ed49d6a4d92b354219077434c57d334620"},{"url":"https://git.kernel.org/stable/c/def7a39091e60e1c4a2f623629082a00092602be"},{"url":"https://git.kernel.org/stable/c/135ba9146f4d38abed48a540ef8a8770ff0bd34f"},{"url":"https://git.kernel.org/stable/c/13271fbbe85d73a7c47058f56a52f2a7f00d6e39"},{"url":"https://git.kernel.org/stable/c/fae381a3d79bb94aa2eb752170d47458d778b797"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T19:17:45.342Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.23","versionEndExcluding":"4.9.337"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.23","versionEndExcluding":"4.14.303"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.23","versionEndExcluding":"4.19.270"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.23","versionEndExcluding":"5.4.229"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.23","versionEndExcluding":"5.10.163"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.23","versionEndExcluding":"5.15.87"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.23","versionEndExcluding":"6.0.18"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.23","versionEndExcluding":"6.1.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.23","versionEndExcluding":"6.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2022-50346","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-01-14T18:20:55.614076Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-908","lang":"en","type":"CWE","description":"CWE-908 Use of Uninitialized Resource"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-14T18:22:58.321Z"}}]}}}