{"id":"CVE-2022-50673","state":"PUBLISHED","title":"ext4: fix use-after-free in ext4_orphan_cleanup","description":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix use-after-free in ext4_orphan_cleanup\n\nI caught a issue as follows:\n==================================================================\n BUG: KASAN: use-after-free in __list_add_valid+0x28/0x1a0\n Read of size 8 at addr ffff88814b13f378 by task mount/710\n\n CPU: 1 PID: 710 Comm: mount Not tainted 6.1.0-rc3-next #370\n Call Trace:\n  <TASK>\n  dump_stack_lvl+0x73/0x9f\n  print_report+0x25d/0x759\n  kasan_report+0xc0/0x120\n  __asan_load8+0x99/0x140\n  __list_add_valid+0x28/0x1a0\n  ext4_orphan_cleanup+0x564/0x9d0 [ext4]\n  __ext4_fill_super+0x48e2/0x5300 [ext4]\n  ext4_fill_super+0x19f/0x3a0 [ext4]\n  get_tree_bdev+0x27b/0x450\n  ext4_get_tree+0x19/0x30 [ext4]\n  vfs_get_tree+0x49/0x150\n  path_mount+0xaae/0x1350\n  do_mount+0xe2/0x110\n  __x64_sys_mount+0xf0/0x190\n  do_syscall_64+0x35/0x80\n  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n  </TASK>\n [...]\n==================================================================\n\nAbove issue may happen as follows:\n-------------------------------------\next4_fill_super\n  ext4_orphan_cleanup\n   --- loop1: assume last_orphan is 12 ---\n    list_add(&EXT4_I(inode)->i_orphan, &EXT4_SB(sb)->s_orphan)\n    ext4_truncate --> return 0\n      ext4_inode_attach_jinode --> return -ENOMEM\n    iput(inode) --> free inode<12>\n   --- loop2: last_orphan is still 12 ---\n    list_add(&EXT4_I(inode)->i_orphan, &EXT4_SB(sb)->s_orphan);\n    // use inode<12> and trigger UAF\n\nTo solve this issue, we need to propagate the return value of\next4_inode_attach_jinode() appropriately.","publishedAt":"2025-12-09T01:29:25.220Z","updatedAt":"2026-08-05T08:59:21.383Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"2c98eb5ea249767bbc11cf4e70e91d5b0458ed13","status":"affected","lessThan":"7f801a1593cb957f73659732836b2dafbdfc7709","versionType":"git"},{"version":"2c98eb5ea249767bbc11cf4e70e91d5b0458ed13","status":"affected","lessThan":"026a4490b5381229a30f23d073b58e8e35ee6858","versionType":"git"},{"version":"2c98eb5ea249767bbc11cf4e70e91d5b0458ed13","status":"affected","lessThan":"7223d5e75f26352354ea2c0ccf8b579821b52adf","versionType":"git"},{"version":"2c98eb5ea249767bbc11cf4e70e91d5b0458ed13","status":"affected","lessThan":"cf0e0817b0f925b70d101d7014ea81b7094e1159","versionType":"git"},{"version":"2c98eb5ea249767bbc11cf4e70e91d5b0458ed13","status":"affected","lessThan":"c2bdbd4c69308835d1b6f6ba74feeccbfe113478","versionType":"git"},{"version":"2c98eb5ea249767bbc11cf4e70e91d5b0458ed13","status":"affected","lessThan":"7908b8a541b1578cc61b4da7f19b604a931441da","versionType":"git"},{"version":"2c98eb5ea249767bbc11cf4e70e91d5b0458ed13","status":"affected","lessThan":"a71248b1accb2b42e4980afef4fa4a27fa0e36f5","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ext4/inode.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.10","versionType":"semver"},{"version":"4.19.270","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.229","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.163","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.87","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.0.18","status":"unaffected","lessThanOrEqual":"6.0.*","versionType":"semver"},{"version":"6.1.4","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ext4/inode.c"]}],"references":["https://git.kernel.org/stable/c/7f801a1593cb957f73659732836b2dafbdfc7709","https://git.kernel.org/stable/c/026a4490b5381229a30f23d073b58e8e35ee6858","https://git.kernel.org/stable/c/7223d5e75f26352354ea2c0ccf8b579821b52adf","https://git.kernel.org/stable/c/cf0e0817b0f925b70d101d7014ea81b7094e1159","https://git.kernel.org/stable/c/c2bdbd4c69308835d1b6f6ba74feeccbfe113478","https://git.kernel.org/stable/c/7908b8a541b1578cc61b4da7f19b604a931441da","https://git.kernel.org/stable/c/a71248b1accb2b42e4980afef4fa4a27fa0e36f5"],"weaknesses":[],"ingestedAt":"2026-10-29T20:05:26.763Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/50xxx/CVE-2022-50673.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-50673","state":"PUBLISHED","datePublished":"2025-12-09T01:29:25.220Z","dateUpdated":"2026-08-05T08:59:21.383Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-12-09T01:26:45.991Z"},"containers":{"cna":{"title":"ext4: fix use-after-free in ext4_orphan_cleanup","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix use-after-free in ext4_orphan_cleanup\n\nI caught a issue as follows:\n==================================================================\n BUG: KASAN: use-after-free in __list_add_valid+0x28/0x1a0\n Read of size 8 at addr ffff88814b13f378 by task mount/710\n\n CPU: 1 PID: 710 Comm: mount Not tainted 6.1.0-rc3-next #370\n Call Trace:\n  <TASK>\n  dump_stack_lvl+0x73/0x9f\n  print_report+0x25d/0x759\n  kasan_report+0xc0/0x120\n  __asan_load8+0x99/0x140\n  __list_add_valid+0x28/0x1a0\n  ext4_orphan_cleanup+0x564/0x9d0 [ext4]\n  __ext4_fill_super+0x48e2/0x5300 [ext4]\n  ext4_fill_super+0x19f/0x3a0 [ext4]\n  get_tree_bdev+0x27b/0x450\n  ext4_get_tree+0x19/0x30 [ext4]\n  vfs_get_tree+0x49/0x150\n  path_mount+0xaae/0x1350\n  do_mount+0xe2/0x110\n  __x64_sys_mount+0xf0/0x190\n  do_syscall_64+0x35/0x80\n  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n  </TASK>\n [...]\n==================================================================\n\nAbove issue may happen as follows:\n-------------------------------------\next4_fill_super\n  ext4_orphan_cleanup\n   --- loop1: assume last_orphan is 12 ---\n    list_add(&EXT4_I(inode)->i_orphan, &EXT4_SB(sb)->s_orphan)\n    ext4_truncate --> return 0\n      ext4_inode_attach_jinode --> return -ENOMEM\n    iput(inode) --> free inode<12>\n   --- loop2: last_orphan is still 12 ---\n    list_add(&EXT4_I(inode)->i_orphan, &EXT4_SB(sb)->s_orphan);\n    // use inode<12> and trigger UAF\n\nTo solve this issue, we need to propagate the return value of\next4_inode_attach_jinode() appropriately."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"2c98eb5ea249767bbc11cf4e70e91d5b0458ed13","status":"affected","lessThan":"7f801a1593cb957f73659732836b2dafbdfc7709","versionType":"git"},{"version":"2c98eb5ea249767bbc11cf4e70e91d5b0458ed13","status":"affected","lessThan":"026a4490b5381229a30f23d073b58e8e35ee6858","versionType":"git"},{"version":"2c98eb5ea249767bbc11cf4e70e91d5b0458ed13","status":"affected","lessThan":"7223d5e75f26352354ea2c0ccf8b579821b52adf","versionType":"git"},{"version":"2c98eb5ea249767bbc11cf4e70e91d5b0458ed13","status":"affected","lessThan":"cf0e0817b0f925b70d101d7014ea81b7094e1159","versionType":"git"},{"version":"2c98eb5ea249767bbc11cf4e70e91d5b0458ed13","status":"affected","lessThan":"c2bdbd4c69308835d1b6f6ba74feeccbfe113478","versionType":"git"},{"version":"2c98eb5ea249767bbc11cf4e70e91d5b0458ed13","status":"affected","lessThan":"7908b8a541b1578cc61b4da7f19b604a931441da","versionType":"git"},{"version":"2c98eb5ea249767bbc11cf4e70e91d5b0458ed13","status":"affected","lessThan":"a71248b1accb2b42e4980afef4fa4a27fa0e36f5","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ext4/inode.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.10","versionType":"semver"},{"version":"4.19.270","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.229","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.163","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.87","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.0.18","status":"unaffected","lessThanOrEqual":"6.0.*","versionType":"semver"},{"version":"6.1.4","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ext4/inode.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/7f801a1593cb957f73659732836b2dafbdfc7709"},{"url":"https://git.kernel.org/stable/c/026a4490b5381229a30f23d073b58e8e35ee6858"},{"url":"https://git.kernel.org/stable/c/7223d5e75f26352354ea2c0ccf8b579821b52adf"},{"url":"https://git.kernel.org/stable/c/cf0e0817b0f925b70d101d7014ea81b7094e1159"},{"url":"https://git.kernel.org/stable/c/c2bdbd4c69308835d1b6f6ba74feeccbfe113478"},{"url":"https://git.kernel.org/stable/c/7908b8a541b1578cc61b4da7f19b604a931441da"},{"url":"https://git.kernel.org/stable/c/a71248b1accb2b42e4980afef4fa4a27fa0e36f5"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through the local VFS mount path (mount → ext4_fill_super → ext4_orphan_cleanup → ext4_process_orphan → ext4_truncate); it is not reachable from network protocol handlers or packet processing.\nAC:L - An attacker who crafts an ext4 image with truncate orphans (nlink>0, non-block-aligned i_size) controls the on-disk state that forces the attach_jinode path; on memory-constrained deployments (Android/embedded/IoT) that ENOMEM is reliably inducible, after which orphan cleanup loops on the same inode and the UAF is deterministic.\nPR:N - No privileges on the target are required—only a malicious ext4 image (USB/SD, disk image, or media presented to udisks/Android vold automount); the attacker need not hold CAP_SYS_ADMIN on the victim host.\nUI:R - ext4 lacks FS_USERNS_MOUNT and mount_capable() requires capable(CAP_SYS_ADMIN) in the init user namespace, so a user or automount daemon must mount the attacker-supplied image for the orphan-cleanup UAF to run.\nS:U - Impact is a host-kernel heap use-after-free during local mount/orphan cleanup within the same OS security authority; there is no VM escape, IOMMU bypass, or other cross-boundary effect.\nC:H - This is a confirmed KASAN use-after-free of an ext4 inode on the orphan list; per UAF guidance, reclaim of the freed object enables arbitrary kernel memory disclosure primitives.\nI:H - The UAF corrupts the orphan list via list_add on a freed inode and enables heap spraying/arbitrary write and control-flow hijack primitives, so integrity impact is High.\nA:H - The KASAN report shows a kernel oops on the freed inode during orphan cleanup, and the stuck s_last_orphan loop can hang or crash the mount path, yielding High availability impact."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T08:59:21.383Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"4.19.270"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"5.4.229"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"5.10.163"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"5.15.87"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"6.0.18"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"6.1.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"6.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-16T15:48:47.172262Z","id":"CVE-2022-50673","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-16T15:49:02.082Z"}}]}}}