CVE-2022-50864

nilfs2: fix shift-out-of-bounds due to too large exponent of block size

published December 30, 2025

CVSS
—
EPSS
0%
Percentile
9.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix shift-out-of-bounds due to too large exponent of block size

If field s_log_block_size of superblock data is corrupted and too large,

init_nilfs() and load_nilfs() still can trigger a shift-out-of-bounds

warning followed by a kernel panic (if panic_on_warn is set):

shift exponent 38973 is too large for 32-bit type 'int'

Call Trace:

<TASK>

dump_stack_lvl+0xcd/0x134

ubsan_epilogue+0xb/0x50

__ubsan_handle_shift_out_of_bounds.cold.12+0x17b/0x1f5

init_nilfs.cold.11+0x18/0x1d [nilfs2]

nilfs_mount+0x9b5/0x12b0 [nilfs2]

...

This fixes the issue by adding and using a new helper function for getting

block size with sanity check.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00200 · 9.4th percentile
Published
2025-12-30T12:15Z
EPSS history
Timeline
  • 30 DEC 12:15Z
    nilfs2: fix shift-out-of-bounds due to too large exponent of block size
    cvelistv5