CVE: CVE-2022-50406
Published: 2025-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

iomap: iomap: fix memory corruption when recording errors during writeback

Every now and then I see this crash on arm64:

Unable to handle kernel NULL pointer dereference at virtual address[PII_REDACTED]0000f8
Buffer I/O error on dev dm-0, logical block 8733687, async page read
Mem abort info:
  ESR = 0x[PII_REDACTED]000006
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x06: level 2 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000006
  CM = 0, WnR = 0
user pgtable: 64k pages, 42-bit VAs, pgdp=[PII_REDACTED]
[[PII_REDACTED]0000f8] pgd=[PII_REDACTED], p4d=[PII_REDACTED], pud=[PII_REDACTED], pmd=[PII_REDACTED]
Internal error: Oops: 96000006 [#1] PREEMPT SMP
Buffer I/O error on dev dm-0, logical block 8733688, async page read
Dumping ftrace buffer:
Buffer I/O error on dev dm-0, logical block 8733689, async page read
   (ftrace buffer empty)
XFS (dm-0): log I/O error -5
Modules linked in: dm_thin_pool dm_persistent_data
XFS (dm-0): Metadata I/O Error (0x1) detected at xfs_trans_read_buf_map+0x1ec/0x590 [xfs] (fs/xfs/xfs_trans_buf.c:296).
 dm_bio_prison
XFS (dm-0): Please unmount the filesystem and rectify the problem(s)
XFS (dm-0): xfs_imap_lookup: xfs_ialloc_read_agi() returned error -5, agno 0
 dm_bufio dm_log_writes xfs nft_chain_nat xt_REDIRECT nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_REJECT
potentially unexpected fatal signal 6.
 nf_reject_ipv6
potentially unexpected fatal signal 6.
 ipt_REJECT nf_reject_ipv4
CPU: 1 PID: 122166 Comm: fsstress Tainted: G        W          6.0.0-rc5-djwa #rc5 3004c9f1de887ebae86015f2677638ce51ee7
 rpcsec_gss_krb5 auth_rpcgss xt_tcpudp ip_set_hash_ip ip_set_hash_net xt_set nft_compat ip_set_hash_mac ip_set nf_tables
Hardware name: QEMU KVM Virtual Machine, BIOS 1.5.1 06/16/2021
pstate: 60001000 (nZCv daif -PAN -UAO -TCO -DIT +SSBS BTYPE=--)
 ip_tables
pc : 000003fd6d7df200
 x_tables
lr : 000003fd6d7df1ec
 overlay nfsv4
CPU: 0 PID: 54031 Comm: u4:3 Tainted: G        W          6.0.0-rc5-djwa #rc5 3004c9f1de887ebae86015f2677638ce51ee7405
Hardware name: QEMU KVM Virtual Machine, BIOS 1.5.1 06/16/2021
Workqueue: writeback wb_workfn
sp : 000003ffd9522fd0
 (flush-253:0)
pstate: 60401005 (nZCv daif +PAN -UAO -TCO -DIT +SSBS BTYPE=--)
pc : errseq_set+0x1c/0x100
x29: 000003ffd9522fd0 x28: [PII_REDACTED] x27: 000002acefeb6780
x26: [PII_REDACTED] x25: [PII_REDACTED] x24: [PII_REDACTED]
x23: 00000000ffffffff x22: [PII_REDACTED]
lr : __filemap_set_wb_err+0x24/0xe0
 x21: [PII_REDACTED]
sp : fffffe000f80f760
x29: fffffe000f80f760 x28: [PII_REDACTED] x27: fffffe000f80f9f8
x26: [PII_REDACTED] x25: 00000000fffffffb x24: fffffe000f80f868
x23: fffffe000f80fbb0 x22: fffffc0180c26a78 x21: [PII_REDACTED]
x20: [PII_REDACTED] x19: [PII_REDACTED] x18: [PII_REDACTED]

x17: [PII_REDACTED] x16: [PII_REDACTED] x15: [PII_REDACTED]
x14: [PII_REDACTED] x13:[PII_REDACTED]470af3 x12: fffffc0058f70000
x11: [PII_REDACTED] x10:[PII_REDACTED]001b20 x9 : fffffe000836b288
x8 : fffffc00eb9fd480 x7 :[PII_REDACTED]f83659 x6 : [PII_REDACTED]
x5 : [PII_REDACTED] x4 : [PII_REDACTED] x3 :[PII_REDACTED]0000f8
x20: 000003fd6d740020 x19:[PII_REDACTED]01dd36 x18: [PII_REDACTED]
x17: 000003fd6d78704c x16: [PII_REDACTED] x15: 000002acfac87668
x2 :[PII_REDACTED]000ffa x1 : 00000000fffffffb x0 :[PII_REDACTED]0000f8
Call trace:
 errseq_set+0x1c/0x100
 __filemap_set_wb_err+0x24/0xe0
 iomap_do_writepage+0x5e4/0xd5c
 write_cache_pages+0x208/0x674
 iomap_writepages+0x34/0x60
 xfs_vm_writepages+0x8c/0xcc [xfs 7a861f39c43631f15d3a5884246ba5035d4ca78b]
x14: [PII_REDACTED] x13: 2064656e72757465 x12: [PII_REDACTED]
x11: 000003fd6d8a82d0 x10: [PII_REDACTED] x9 : 000003fd6d8ae288
x8 : [PII_REDACTED] x7 : 00000000ffffffff x6 : 00000000ffffffee
x5 : 00000000fbad2887 x4 : 000003fd6d9abb58 x3 : 000003fd6d740020
x2 : [PII_REDACTED] x1 :[PII_REDACTED]01dd36 x0 : [PII_REDACTED]
CPU: 
---truncated---
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://git.kernel.org/stable/c/3d5f3ba1ac28059bdf7000cae2403e4e984308d2; https://git.kernel.org/stable/c/7308591d9c7787aec58f6a01a7823f14e90db7a2; https://git.kernel.org/stable/c/82c66c46f73b88be74c869e2cbfef45281adf3c6