CVE-2022-50367

fs: fix UAF/GPF bug in nilfs_mdt_destroy

State: Published
Severity: 7.8 High
Published: Sep 17, 2025
Updated: Aug 5, 2026
Reserved: Sep 17, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

fs: fix UAF/GPF bug in nilfs_mdt_destroy

In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc() fails, which causes inode->i_private uninitialized. Then nilfs_is_metadata_file_inode() returns true and nilfs_free_inode() wrongly calls nilfs_mdt_destroy(), which frees the uninitialized inode->i_private and leads to crashes(e.g., UAF/GPF).

Fix this by moving security_inode_alloc just prior to this_cpu_inc(nr_inodes)

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d1ff475d7c83289d0a7faef346ea3bbf90818badAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c0aa76b0f17f59dd9c9d3463550a2986a1d592e4Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ec2aab115eb38ac4992ea2fcc2a02fbe7af5cf48Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 70e4f70d54e0225f91814e8610477d65f33cefe4Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 1e555c3ed1fce4b278aaebe18a64a934cece57d8Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 64b79e632869ad3ef6c098a4731d559381da1115Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 81de80330fa6907aec32eb54c5619059e6e36452Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2a96b532098284ecf8e4849b8b9e5fc7a28bdee9Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2e488f13755ffbb60f307e991b27024716a33b29Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 4.9.331 through 4.9.Not affected 4.14.296 through 4.14.Not affected 4.19.262 through 4.19.Not affected 5.4.218 through 5.4.Not affected 5.10.148 through 5.10.Not affected 5.15.73 through 5.15.Not affected 5.19.15 through 5.19.Not affected 6.0.1 through 6.0.Not affected 6.1 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d1ff475d7c83289d0a7faef346ea3bbf90818badAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c0aa76b0f17f59dd9c9d3463550a2986a1d592e4Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ec2aab115eb38ac4992ea2fcc2a02fbe7af5cf48Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 70e4f70d54e0225f91814e8610477d65f33cefe4Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 1e555c3ed1fce4b278aaebe18a64a934cece57d8Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 64b79e632869ad3ef6c098a4731d559381da1115Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 81de80330fa6907aec32eb54c5619059e6e36452Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2a96b532098284ecf8e4849b8b9e5fc7a28bdee9Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2e488f13755ffbb60f307e991b27024716a33b29Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
4.9.331 through 4.9.*Not affected
4.14.296 through 4.14.*Not affected
4.19.262 through 4.19.*Not affected
5.4.218 through 5.4.*Not affected
5.10.148 through 5.10.*Not affected
5.15.73 through 5.15.*Not affected
5.19.15 through 5.19.*Not affected
6.0.1 through 6.0.*Not affected
6.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.