Riskcovery

CVE-2022-49879

ext4: fix BUG_ON() when directory entry has invalid rec_len

State
Published
Severity
Not scored
Published
May 1, 2025
Updated
May 11, 2026
Reserved
May 1, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix BUG_ON() when directory entry has invalid rec_len

The rec_len field in the directory entry has to be a multiple of 4. A corrupted filesystem image can be used to hit a BUG() in ext4_rec_len_to_disk(), called from make_indexed_dir().

------------[ cut here ]------------ kernel BUG at fs/ext4/ext4.h:2413! ... RIP: 0010:make_indexed_dir+0x53f/0x5f0 ... Call Trace: <TASK> ? add_dirent_to_buf+0x1b2/0x200 ext4_add_entry+0x36e/0x480 ext4_add_nondir+0x2b/0xc0 ext4_create+0x163/0x200 path_openat+0x635/0xe90 do_filp_open+0xb4/0x160 ? __create_object.isra.0+0x1de/0x3b0 ? _raw_spin_unlock+0x12/0x30 do_sys_openat2+0x91/0x150 __x64_sys_open+0x6c/0xa0 do_syscall_64+0x3c/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0

The fix simply adds a call to ext4_check_dir_entry() to validate the directory entry, returning -EFSCORRUPTED if the entry is invalid.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 3d0518f4758eca4339e75e5b9dbb7e06a5ce08b4 to before 2fa24d0274fbf913b56ee31f15bc01168669d909Affected
  • 3d0518f4758eca4339e75e5b9dbb7e06a5ce08b4 to before 156451a67b93986fb07c274ef6995ff40766c5adAffected
  • 3d0518f4758eca4339e75e5b9dbb7e06a5ce08b4 to before 999cff2b6ce3b45c08abf793bf55534777421327Affected
  • 3d0518f4758eca4339e75e5b9dbb7e06a5ce08b4 to before ce1ee2c8827fb6493e91acbd50f664cf2a972c3dAffected
  • 3d0518f4758eca4339e75e5b9dbb7e06a5ce08b4 to before 17a0bc9bd697f75cfdf9b378d5eb2d7409c91340Affected
LinuxLinux
  • 2.6.30Affected
  • before 2.6.30Not affected
  • 5.4.224 through 5.4.*Not affected
  • 5.10.154 through 5.10.*Not affected
  • 5.15.78 through 5.15.*Not affected
  • 6.0.8 through 6.0.*Not affected
  • 6.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.