CVE-2022-50367

fs: fix UAF/GPF bug in nilfs_mdt_destroy

High · published September 17, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
12.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

fs: fix UAF/GPF bug in nilfs_mdt_destroy

In alloc_inode, inode_init_always() could return -ENOMEM if

security_inode_alloc() fails, which causes inode->i_private

uninitialized. Then nilfs_is_metadata_file_inode() returns

true and nilfs_free_inode() wrongly calls nilfs_mdt_destroy(),

which frees the uninitialized inode->i_private

and leads to crashes(e.g., UAF/GPF).

Fix this by moving security_inode_alloc just prior to

this_cpu_inc(nr_inodes)

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00225 · 12.5th percentile
Published
2025-09-17T14:56Z
EPSS history
Timeline
  • 17 SEP 14:56Z
    fs: fix UAF/GPF bug in nilfs_mdt_destroy
    cvelistv5