CVE-2022-50485

ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode

State: Published
Severity: Not scored
Published: Oct 4, 2025
Updated: May 11, 2026
Reserved: Oct 4, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode

There are many places that will get unhappy (and crash) when ext4_iget() returns a bad inode. However, if iget the boot loader inode, allows a bad inode to be returned, because the inode may not be initialized. This mechanism can be used to bypass some checks and cause panic. To solve this problem, we add a special iget flag EXT4_IGET_BAD. Only with this flag we'd be returning bad inode from ext4_iget(), otherwise we always return the error code if the inode is bad inode.(suggested by Jan Kara)

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	393d1d1d76933886d5e1ce603214c9987589c6d5 to before 2142dfa1de61e25b83198af0308ec7689cca25d3Affected 393d1d1d76933886d5e1ce603214c9987589c6d5 to before c0a738875c2e9c8c3366d792f8bf7fe508d5e5a5Affected 393d1d1d76933886d5e1ce603214c9987589c6d5 to before f7e6b5548f915d7aa435d0764d41eacfb49c6e09Affected 393d1d1d76933886d5e1ce603214c9987589c6d5 to before f725b290ed79ad61e4f721fee95a287892d8b1adAffected 393d1d1d76933886d5e1ce603214c9987589c6d5 to before 488a5c2bf7543c3cd3f07a025f2e62be91599430Affected 393d1d1d76933886d5e1ce603214c9987589c6d5 to before 63b1e9bccb71fe7d7e3ddc9877dbdc85e5d2d023Affected
LinuxLinux	3.10Affected before 3.10Not affected 5.4.229 through 5.4.Not affected 5.10.163 through 5.10.Not affected 5.15.87 through 5.15.Not affected 6.0.18 through 6.0.Not affected 6.1.4 through 6.1.*Not affected 6.2 and laterNot affected

Product

Versions

LinuxLinux

393d1d1d76933886d5e1ce603214c9987589c6d5 to before 2142dfa1de61e25b83198af0308ec7689cca25d3Affected
393d1d1d76933886d5e1ce603214c9987589c6d5 to before c0a738875c2e9c8c3366d792f8bf7fe508d5e5a5Affected
393d1d1d76933886d5e1ce603214c9987589c6d5 to before f7e6b5548f915d7aa435d0764d41eacfb49c6e09Affected
393d1d1d76933886d5e1ce603214c9987589c6d5 to before f725b290ed79ad61e4f721fee95a287892d8b1adAffected
393d1d1d76933886d5e1ce603214c9987589c6d5 to before 488a5c2bf7543c3cd3f07a025f2e62be91599430Affected
393d1d1d76933886d5e1ce603214c9987589c6d5 to before 63b1e9bccb71fe7d7e3ddc9877dbdc85e5d2d023Affected

LinuxLinux

3.10Affected
before 3.10Not affected
5.4.229 through 5.4.*Not affected
5.10.163 through 5.10.*Not affected
5.15.87 through 5.15.*Not affected
6.0.18 through 6.0.*Not affected
6.1.4 through 6.1.*Not affected
6.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.