CVE-2022-50864

nilfs2: fix shift-out-of-bounds due to too large exponent of block size

State: Published
Severity: Not scored
Published: Dec 30, 2025
Updated: May 11, 2026
Reserved: Dec 30, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix shift-out-of-bounds due to too large exponent of block size

If field s_log_block_size of superblock data is corrupted and too large, init_nilfs() and load_nilfs() still can trigger a shift-out-of-bounds warning followed by a kernel panic (if panic_on_warn is set):

shift exponent 38973 is too large for 32-bit type 'int' Call Trace: <TASK> dump_stack_lvl+0xcd/0x134 ubsan_epilogue+0xb/0x50 __ubsan_handle_shift_out_of_bounds.cold.12+0x17b/0x1f5 init_nilfs.cold.11+0x18/0x1d [nilfs2] nilfs_mount+0x9b5/0x12b0 [nilfs2] ...

This fixes the issue by adding and using a new helper function for getting block size with sanity check.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8a9d2191e9f43bbcd256a9a6871bd73434c83f2f to before ec93b5430ec0f60877a5388bb023d60624f9ab9fAffected 8a9d2191e9f43bbcd256a9a6871bd73434c83f2f to before 8b6ef451b5701b37d9a5905534595776a662edfcAffected 8a9d2191e9f43bbcd256a9a6871bd73434c83f2f to before ddb6615a168f97b91175e00eda4c644741cf531cAffected 8a9d2191e9f43bbcd256a9a6871bd73434c83f2f to before a16731fa1b96226c75bbf18e73513b14fc318360Affected 8a9d2191e9f43bbcd256a9a6871bd73434c83f2f to before ebeccaaef67a4895d2496ab8d9c2fb8d89201211Affected
LinuxLinux	2.6.30Affected before 2.6.30Not affected 5.10.163 through 5.10.Not affected 5.15.86 through 5.15.Not affected 6.0.16 through 6.0.Not affected 6.1.2 through 6.1.Not affected 6.2 and laterNot affected

Product

Versions

LinuxLinux

8a9d2191e9f43bbcd256a9a6871bd73434c83f2f to before ec93b5430ec0f60877a5388bb023d60624f9ab9fAffected
8a9d2191e9f43bbcd256a9a6871bd73434c83f2f to before 8b6ef451b5701b37d9a5905534595776a662edfcAffected
8a9d2191e9f43bbcd256a9a6871bd73434c83f2f to before ddb6615a168f97b91175e00eda4c644741cf531cAffected
8a9d2191e9f43bbcd256a9a6871bd73434c83f2f to before a16731fa1b96226c75bbf18e73513b14fc318360Affected
8a9d2191e9f43bbcd256a9a6871bd73434c83f2f to before ebeccaaef67a4895d2496ab8d9c2fb8d89201211Affected

LinuxLinux

2.6.30Affected
before 2.6.30Not affected
5.10.163 through 5.10.*Not affected
5.15.86 through 5.15.*Not affected
6.0.16 through 6.0.*Not affected
6.1.2 through 6.1.*Not affected
6.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.