huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2022-50673: kernel: ext4: fix use-after-free in ext4_orphan_cleanup
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-12-09T00:00:00+00:00

A use-after-free vulnerability was found in the ext4 filesystem's orphan inode cleanup routine in the Linux kernel. When ext4_inode_attach_jinode() fails with -ENOMEM during orphan cleanup at mount time, the error is not properly propagated. The inode is freed via iput(), but the orphan list still references the same inode number. On the next loop iteration, the freed inode structure is reused, triggering a use-after-free when adding it to the orphan list.

Statement: This flaw occurs during ext4 filesystem mount when memory allocation fails at a specific point in orphan inode processing. Exploitation requires local access to mount ext4 filesystems and the ability to induce memory pressure during the mount operation, making practical exploitation difficult.

Affected upstream versions: 4.10
Fixed upstream versions: 0, 4.19.270, 5.10.163, 5.15.87, 5.4.229, 6.0.18, 6.1.4, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7f801a1593cb957f73659732836b2dafbdfc7709
CVE-2022-50677: kernel: ipmi: fix use after free in _ipmi_destroy_user()
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A use-after-free flaw was found in the IPMI driver in the Linux kernel. In _ipmi_destroy_user(), the intf_free() function frees the interface pointer, but the code subsequently attempts to dereference this freed pointer. This could result in kernel crashes or potentially allow an attacker with local access to escalate privileges.

Statement: The bug involves a straightforward use-after-free but occurs in a narrow code path during IPMI interface teardown. Exploiting this for privilege escalation would require precise timing and IPMI hardware access.

Affected upstream versions: 4.19.92 < 4.19.270, 5.4.7 < 5.4.229, 5.5
Fixed upstream versions: 0, 4.19.270, 5.10.163, 5.15.87, 5.4.229, 6.0.18, 6.1.4, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 35ad87bfe330f7ef6a19f772223c63296d643172
CVE-2022-50678: kernel: wifi: brcmfmac: fix invalid address access when enabling SCAN log level
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A NULL pointer dereference vulnerability was found in the Broadcom brcmfmac wireless driver in the Linux kernel. When the SCAN debug log level is enabled, a loop variable 'i' is incorrectly modified when setting random MAC addresses. This causes an invalid memory access when attempting to print debug information using the corrupted index value, leading to a kernel crash.

Statement: This is a NULL pointer dereference in the brcmfmac wireless driver that can cause a kernel crash when SCAN debug logging is enabled. The vulnerability requires local access and typically only affects debugging scenarios.

Affected upstream versions: 4.13
Fixed upstream versions: 0, 4.14.296, 4.19.262, 5.10.150, 5.15.75, 5.19.17, 5.4.220, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7ccb0529446ae68a8581916bfc95c353306d76ba
CVE-2022-50679: kernel: i40e: Fix DMA mappings leak
Component: kernel
Severity: Low
CWE: CWE-763 (Release of Invalid Pointer or Reference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A DMA mapping leak vulnerability was found in the Intel i40e network driver in the Linux kernel. During reallocation of RX buffers when changing ring parameters via ethtool, DMA mappings are not properly cleaned up before creating new ones. Repeated ring size changes can exhaust DMA resources, leading to memory allocation failures and kernel warnings when XDP queue information cannot be unregistered properly.

Statement: This is a resource leak in the Intel i40e network driver that can be triggered by repeatedly changing ring buffer sizes via ethtool. The impact is limited to systems with Intel Ethernet 700 Series adapters and requires root-level access to modify network device parameters.

Affected upstream versions: 5.8
Fixed upstream versions: 0, 5.10.152, 5.15.76, 6.0.6, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ed5baf3d0a33caaca4cd4073ebb0854cc77a616d
CVE-2022-50698: kernel: ASoC: da7219: Fix an error handling path in da7219_register_dai_clks()
Component: kernel
Severity: Low
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's ASoC da7219 audio codec driver. An error handling path in da7219_register_dai_clks() incorrectly attempts to unregister a clock that was never successfully registered. This could lead to incorrect resource cleanup during driver probe failure, potentially causing system instability.

Statement: This is an error handling path bug that only manifests during driver probe failures for the da7219 audio codec. The issue requires specific hardware (Dialog Semiconductor DA7219) and a failure condition during clock registration. Normal operation is unaffected, and the practical exploit scenario is very limited.

Affected upstream versions: 5.10
Fixed upstream versions: 0, 5.10.150, 5.15.75, 5.19.17, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4993c1511d66326f1037bc5156b024a6a96d23ef
CVE-2022-50699: kernel: selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context()
Component: kernel
Severity: Low
CWE: CWE-663 (Use of a Non-reentrant Function in a Concurrent Context)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context()

The following warning was triggered on a hardware environment:

  SELinux: Converting 162 SID table entries...
  BUG: sleeping function called from invalid context at
       __might_sleep+0x60/0x74 0x0
  in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 5943, name: tar
  CPU: 7 PID: 5943 Comm: tar Tainted: P O 5.10.0 #1
  Call trace:
   dump_backtrace+0x0/0x1c8
   show_stack+0x18/0x28
   dump_stack+0xe8/0x15c
   ___might_sleep+0x168/0x17c
   __might_sleep+0x60/0x74
   __kmalloc_track_caller+0xa0/0x7dc
   kstrdup+0x54/0xac
   convert_context+0x48/0x2e4
   sidtab_context_to_sid+0x1c4/0x36c
   security_context_to_sid_core+0x168/0x238
   security_context_to_sid_default+0x14/0x24
   inode_doinit_use_xattr+0x164/0x1e4
   inode_doinit_with_dentry+0x1c0/0x488
   selinux_d_instantiate+0x20/0x34
   security_d_instantiate+0x70/0xbc
   d_splice_alias+0x4c/0x3c0
   ext4_lookup+0x1d8/0x200 [ext4]
   __lookup_slow+0x12c/0x1e4
   walk_component+0x100/0x200
   path_lookupat+0x88/0x118
   filename_lookup+0x98/0x130
   user_path_at_empty+0x48/0x60
   vfs_statx+0x84/0x140
   vfs_fstatat+0x20/0x30
   __se_sys_newfstatat+0x30/0x74
   __arm64_sys_newfstatat+0x1c/0x2c
   el0_svc_common.constprop.0+0x100/0x184
   do_el0_svc+0x1c/0x2c
   el0_svc+0x20/0x34
   el0_sync_handler+0x80/0x17c
   el0_sync+0x13c/0x140
  SELinux: Context system_u:object_r:pssp_rsyslog_log_t:s0:c0 is
           not valid (left unmapped).

It was found that within a critical section of spin_lock_irqsave in
sidtab_context_to_sid(), convert_context() (hooked by
sidtab_convert_params.func) might cause the process to sleep via
allocating memory with GFP_KERNEL, which is problematic.

As Ondrej pointed out [1], convert_context()/sidtab_convert_params.func
has another caller sidtab_convert_tree(), which is okay with GFP_KERNEL.
Therefore, fix this problem by adding a gfp_t argument for
convert_context()/sidtab_convert_params.func and pass GFP_KERNEL/_ATOMIC
properly in individual callers.

[PM: wrap long BUG() output lines, tweak subject line]


Affected upstream versions: 5.0
Fixed upstream versions: 0, 5.10.152, 5.15.76, 6.0.6, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2723875e9d677401d775a03a72abab7e9538c20c
CVE-2022-50702: kernel: Linux kernel: Memory leak in vdpa_sim leading to denial of service
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the vdpa_sim component of the Linux kernel. This memory leak vulnerability occurs when a module is probed and the device_register() function fails within vdpasim_net_init() or vdpasim_blk_init(). In such a scenario, the reference count of the kobject is not properly decreased, leading to the leakage of the allocated device name. A local attacker could exploit this flaw to cause a denial of service (DoS) due to resource exhaustion.


Affected upstream versions: 5.12
Fixed upstream versions: 0, 5.15.87, 6.0.19, 6.1.5, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 586e6fd7d581f987f7d0d2592edf0b26397e783e
CVE-2022-50703: kernel: Kernel: Denial of Service via refcount leak in qcom_smsm_probe()
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel. A local attacker with low privileges could exploit a refcount leak in the `qcom_smsm_probe()` function. This could lead to a Denial of Service (DoS) due to resource exhaustion, making the system unavailable.


Affected upstream versions: 4.5
Fixed upstream versions: 0, 4.14.296, 4.19.262, 4.9.331, 5.10.150, 5.15.75, 5.19.17, 5.4.220, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1bbe75d466e5118b7d49ef4a346c3ce5742da4e8
CVE-2022-50710: kernel: Linux kernel: Denial of Service in ice driver via uninitialized transmit rings
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's ice network driver. A local user, by changing the number of transmit queues using the ethtool utility, can trigger an issue where newly allocated transmit rings are not properly initialized. This can lead to a null pointer dereference, causing a system crash and a Denial of Service (DoS).


Affected upstream versions: 5.14
Fixed upstream versions: 0, 5.15.75, 5.19.17, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 624f03a027f2b18647cc4f1a7a81920a1e4e0201
CVE-2022-50714: kernel: Linux kernel: Denial of Service in mt7921e driver during module unload
Component: kernel
Severity: Moderate
CWE: CWE-457 (Use of Uninitialized Variable)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was discovered in the mt76/mt7921e Wi-Fi driver in the Linux kernel where improper handling of driver data during module removal can lead to a crash. Under certain insmod/rmmod stress test conditions, the driver’s mt7921_pci_remove() function is called while the associated mt76_dev (driver private data) has not been properly initialized or is missing. When the workqueue cancellation logic attempts to access this uninitialized data, it triggers a KASAN BUG: user-memory-access, resulting in a kernel panic or hang.


Affected upstream versions: 5.18
Fixed upstream versions: 0, 5.19.17, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1034d8e08508830161377f136a060e78fc24f2a5
CVE-2022-50715: kernel: md/raid1: stop mdx_raid1 thread when raid1 array run failed
Component: kernel
Severity: Low
CWE: CWE-826 (Premature Release of Resource During Expected Lifetime)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

md/raid1: stop mdx_raid1 thread when raid1 array run failed

fail run raid1 array when we assemble array with the inactive disk only,
but the mdx_raid1 thread were not stop, Even if the associated resources
have been released. it will caused a NULL dereference when we do poweroff.

This causes the following Oops:
    [  287.587787] BUG: kernel NULL pointer dereference, address: 0000000000000070
    [  287.594762] #PF: supervisor read access in kernel mode
    [  287.599912] #PF: error_code(0x0000) - not-present page
    [  287.605061] PGD 0 P4D 0
    [  287.607612] Oops: 0000 [#1] SMP NOPTI
    [  287.611287] CPU: 3 PID: 5265 Comm: md0_raid1 Tainted: G     U            5.10.146 #0
    [  287.619029] Hardware name: xxxxxxx/To be filled by O.E.M, BIOS 5.19 06/16/2022
    [  287.626775] RIP: 0010:md_check_recovery+0x57/0x500 [md_mod]
    [  287.632357] Code: fe 01 00 00 48 83 bb 10 03 00 00 00 74 08 48 89 ......
    [  287.651118] RSP: 0018:ffffc90000433d78 EFLAGS: 00010202
    [  287.656347] RAX: 0000000000000000 RBX: ffff888105986800 RCX: 0000000000000000
    [  287.663491] RDX: ffffc90000433bb0 RSI: 00000000ffffefff RDI: ffff888105986800
    [  287.670634] RBP: ffffc90000433da0 R08: 0000000000000000 R09: c0000000ffffefff
    [  287.677771] R10: 0000000000000001 R11: ffffc90000433ba8 R12: ffff888105986800
    [  287.684907] R13: 0000000000000000 R14: fffffffffffffe00 R15: ffff888100b6b500
    [  287.692052] FS:  0000000000000000(0000) GS:ffff888277f80000(0000) knlGS:0000000000000000
    [  287.700149] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [  287.705897] CR2: 0000000000000070 CR3: 000000000320a000 CR4: 0000000000350ee0
    [  287.713033] Call Trace:
    [  287.715498]  raid1d+0x6c/0xbbb [raid1]
    [  287.719256]  ? __schedule+0x1ff/0x760
    [  287.722930]  ? schedule+0x3b/0xb0
    [  287.726260]  ? schedule_timeout+0x1ed/0x290
    [  287.730456]  ? __switch_to+0x11f/0x400
    [  287.734219]  md_thread+0xe9/0x140 [md_mod]
    [  287.738328]  ? md_thread+0xe9/0x140 [md_mod]
    [  287.742601]  ? wait_woken+0x80/0x80
    [  287.746097]  ? md_register_thread+0xe0/0xe0 [md_mod]
    [  287.751064]  kthread+0x11a/0x140
    [  287.754300]  ? kthread_park+0x90/0x90
    [  287.757974]  ret_from_fork+0x1f/0x30

In fact, when raid1 array run fail, we need to do
md_unregister_thread() before raid1_free().


Affected upstream versions: 4.9.195 < 4.9.337, 4.14.147 < 4.14.303, 4.19.77 < 4.19.270, 4.4.195 < 4.5, 5.2.19 < 5.3, 5.3.4 < 5.4, 5.4
Fixed upstream versions: 0, 4.14.303, 4.19.270, 4.5, 4.9.337, 5.10.163, 5.15.86, 5.3, 5.4, 5.4.229, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d684ceb77311410aeaf5189d321f9f564838c49a
CVE-2022-50717: kernel: nvmet-tcp: add bounds check on Transfer Tag
Component: kernel
Severity: Moderate
CWE: CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nvmet-tcp: add bounds check on Transfer Tag

ttag is used as an index to get cmd in nvmet_tcp_handle_h2c_data_pdu(),
add a bounds check to avoid out-of-bounds access.


Affected upstream versions: 5.0
Fixed upstream versions: 0, 5.10.150, 5.15.75, 5.19.17, 5.4.220, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0d150ccd55dbfad36f55855b40b381884c98456e
CVE-2022-50718: kernel: Linux kernel: Denial of Service due to PCI device reference count leak
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel. A local low-privileged user could exploit a reference count leak in the `drm/amdgpu` component. This vulnerability, related to how PCI (Peripheral Component Interconnect) devices are managed, could lead to a Denial of Service (DoS) by exhausting system resources.


Affected upstream versions: 5.8
Fixed upstream versions: 0, 5.10.163, 5.15.86, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3725a8f26bdbc38dfdf545836117f1e069277c91
CVE-2022-50720: kernel: x86/apic: Don't disable x2APIC if locked
Component: kernel
Severity: Low
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

x86/apic: Don't disable x2APIC if locked

The APIC supports two modes, legacy APIC (or xAPIC), and Extended APIC
(or x2APIC).  X2APIC mode is mostly compatible with legacy APIC, but
it disables the memory-mapped APIC interface in favor of one that uses
MSRs.  The APIC mode is controlled by the EXT bit in the APIC MSR.

The MMIO/xAPIC interface has some problems, most notably the APIC LEAK
[1].  This bug allows an attacker to use the APIC MMIO interface to
extract data from the SGX enclave.

Introduce support for a new feature that will allow the BIOS to lock
the APIC in x2APIC mode.  If the APIC is locked in x2APIC mode and the
kernel tries to disable the APIC or revert to legacy APIC mode a GP
fault will occur.

Introduce support for a new MSR (IA32_XAPIC_DISABLE_STATUS) and handle
the new locked mode when the LEGACY_XAPIC_DISABLED bit is set by
preventing the kernel from trying to disable the x2APIC.

On platforms with the IA32_XAPIC_DISABLE_STATUS MSR, if SGX or TDX are
enabled the LEGACY_XAPIC_DISABLED will be set by the BIOS.  If
legacy APIC is required, then it SGX and TDX need to be disabled in the
BIOS.

[1]: https://aepicleak.com/aepicleak.pdf


Affected upstream versions: 3.3
Fixed upstream versions: 0, 5.19.17, 6.0.3, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 05785ba834f23272f9d23427ae4a80ac505a5296
CVE-2022-50723: kernel: Kernel: Denial of Service via memory leak in bnxt_nvm_test()
Component: kernel
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel. A local user could exploit a memory leak in the `bnxt_nvm_test()` function. This vulnerability, categorized as a memory corruption issue, could lead to a Denial of Service (DoS) by exhausting system resources.


Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.0.6, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: be083d97031712a2e16fd915ddb8fe1a6cb1fbc5
CVE-2022-50726: kernel: net/mlx5: Fix possible use-after-free in async command interface
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.2 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the net/mlx5 subsystem of the Linux kernel where a race condition in the asynchronous command interface can lead to a use-after-free condition. The function mlx5_cmd_cleanup_async_ctx may return before all callback handlers have completed, allowing the context to be freed while another thread still references it. Under certain sequences of events, this can result in invalid memory access and potentially escalate privileges or cause kernel instability on affected systems


Affected upstream versions: 5.1
Fixed upstream versions: 0, 5.10.153, 5.15.77, 5.4.223, 6.0.7, 6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 69dd3ad406c49aa69ce4852c15231ac56af8caf9
CVE-2022-50728: kernel: Linux kernel: Denial of Service in s390/lcs network driver due to incompatible function pointer type
Component: kernel
Severity: Low
CWE: CWE-628 (Function Call with Incorrectly Specified Arguments)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's s390/lcs network driver. An incorrect function pointer type in the `lcs_start_xmit()` function could lead to a system crash or termination of a process. This issue arises when Kernel Control Flow Integrity (kCFI), a security feature designed to prevent certain types of attacks, is enabled. A local attacker could potentially exploit this to cause a Denial of Service (DoS) on the system.


Affected upstream versions: 2.6.32
Fixed upstream versions: 0, 4.14.303, 4.19.270, 4.9.337, 5.10.163, 5.15.86, 5.4.229, 6.0.16, 6.1.2, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7b4da3fcd513b8e67823eb80da37aad99b3339c1
CVE-2022-50730: kernel: ext4: silence the warning when evicting inode with dioread_nolock
Component: kernel
Severity: Low
CWE: CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ext4: silence the warning when evicting inode with dioread_nolock

When evicting an inode with default dioread_nolock, it could be raced by
the unwritten extents converting kworker after writeback some new
allocated dirty blocks. It convert unwritten extents to written, the
extents could be merged to upper level and free extent blocks, so it
could mark the inode dirty again even this inode has been marked
I_FREEING. But the inode->i_io_list check and warning in
ext4_evict_inode() missing this corner case. Fortunately,
ext4_evict_inode() will wait all extents converting finished before this
check, so it will not lead to inode use-after-free problem, every thing
is OK besides this warning. The WARN_ON_ONCE was originally designed
for finding inode use-after-free issues in advance, but if we add
current dioread_nolock case in, it will become not quite useful, so fix
this warning by just remove this check.

 ======
 WARNING: CPU: 7 PID: 1092 at fs/ext4/inode.c:227
 ext4_evict_inode+0x875/0xc60
 ...
 RIP: 0010:ext4_evict_inode+0x875/0xc60
 ...
 Call Trace:
  <TASK>
  evict+0x11c/0x2b0
  iput+0x236/0x3a0
  do_unlinkat+0x1b4/0x490
  __x64_sys_unlinkat+0x4c/0xb0
  do_syscall_64+0x3b/0x90
  entry_SYSCALL_64_after_hwframe+0x46/0xb0
 RIP: 0033:0x7fa933c1115b
 ======

rm                          kworker
                            ext4_end_io_end()
vfs_unlink()
 ext4_unlink()
                             ext4_convert_unwritten_io_end_vec()
                              ext4_convert_unwritten_extents()
                               ext4_map_blocks()
                                ext4_ext_map_blocks()
                                 ext4_ext_try_to_merge_up()
                                  __mark_inode_dirty()
                                   check !I_FREEING
                                   locked_inode_to_wb_and_lock_list()
 iput()
  iput_final()
   evict()
    ext4_evict_inode()
     truncate_inode_pages_final() //wait release io_end
                                    inode_io_list_move_locked()
                             ext4_release_io_end()
     trigger WARN_ON_ONCE()


Affected upstream versions: 5.8
Fixed upstream versions: 0, 5.10.163, 5.15.87, 6.0.18, 6.1.4, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: bdc698ce91f232fd5eb11d2373e9f82f687314b8