GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49414 (GCVE-0-2022-49414)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:12 – Updated: 2026-05-11 18:59
VLAI
Title
ext4: fix race condition between ext4_write and ext4_convert_inline_data
Summary
In the Linux kernel, the following vulnerability has been resolved: ext4: fix race condition between ext4_write and ext4_convert_inline_data Hulk Robot reported a BUG_ON: ================================================================== EXT4-fs error (device loop3): ext4_mb_generate_buddy:805: group 0, block bitmap and bg descriptor inconsistent: 25 vs 31513 free clusters kernel BUG at fs/ext4/ext4_jbd2.c:53! invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 PID: 25371 Comm: syz-executor.3 Not tainted 5.10.0+ #1 RIP: 0010:ext4_put_nojournal fs/ext4/ext4_jbd2.c:53 [inline] RIP: 0010:__ext4_journal_stop+0x10e/0x110 fs/ext4/ext4_jbd2.c:116 [...] Call Trace: ext4_write_inline_data_end+0x59a/0x730 fs/ext4/inline.c:795 generic_perform_write+0x279/0x3c0 mm/filemap.c:3344 ext4_buffered_write_iter+0x2e3/0x3d0 fs/ext4/file.c:270 ext4_file_write_iter+0x30a/0x11c0 fs/ext4/file.c:520 do_iter_readv_writev+0x339/0x3c0 fs/read_write.c:732 do_iter_write+0x107/0x430 fs/read_write.c:861 vfs_writev fs/read_write.c:934 [inline] do_pwritev+0x1e5/0x380 fs/read_write.c:1031 [...] ================================================================== Above issue may happen as follows: cpu1 cpu2 __________________________|__________________________ do_pwritev vfs_writev do_iter_write ext4_file_write_iter ext4_buffered_write_iter generic_perform_write ext4_da_write_begin vfs_fallocate ext4_fallocate ext4_convert_inline_data ext4_convert_inline_data_nolock ext4_destroy_inline_data_nolock clear EXT4_STATE_MAY_INLINE_DATA ext4_map_blocks ext4_ext_map_blocks ext4_mb_new_blocks ext4_mb_regular_allocator ext4_mb_good_group_nolock ext4_mb_init_group ext4_mb_init_cache ext4_mb_generate_buddy --> error ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA) ext4_restore_inline_data set EXT4_STATE_MAY_INLINE_DATA ext4_block_write_begin ext4_da_write_end ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA) ext4_write_inline_data_end handle=NULL ext4_journal_stop(handle) __ext4_journal_stop ext4_put_nojournal(handle) ref_cnt = (unsigned long)handle BUG_ON(ref_cnt == 0) ---> BUG_ON The lock held by ext4_convert_inline_data is xattr_sem, but the lock held by generic_perform_write is i_rwsem. Therefore, the two locks can be concurrent. To solve above issue, we add inode_lock() for ext4_convert_inline_data(). At the same time, move ext4_convert_inline_data() in front of ext4_punch_hole(), remove similar handling from ext4_punch_hole().
Severity
4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 19:41 UTC
CWE
  • CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf , < 18881d7e517169193d9ef6c89c7f322e3e164277 (git)
Affected: 0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf , < 91f90b571f1a23f5b8a9c2b68a9aa5d6981a3c3d (git)
Affected: 0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf , < 14602353b350950b551eccc6b46411aa3b12ffe2 (git)
Affected: 0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf , < 725e00cb7039eae291890f1bb19bc867176745f6 (git)
Affected: 0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf , < ccc6639f831bee91aa8b41c8a1cdd020ecfb9f32 (git)
Affected: 0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf , < f87c7a4b084afc13190cbb263538e444cb2b392a (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.8
Unaffected: 0 , < 3.8 (semver)
Unaffected: 5.4.207 , ≤ 5.4.* (semver)
Unaffected: 5.10.132 , ≤ 5.10.* (semver)
Unaffected: 5.15.46 , ≤ 5.15.* (semver)
Unaffected: 5.17.14 , ≤ 5.17.* (semver)
Unaffected: 5.18.3 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 4.7,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49414",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:41:09.175529Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:46:50.027Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/extents.c",
            "fs/ext4/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "18881d7e517169193d9ef6c89c7f322e3e164277",
              "status": "affected",
              "version": "0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf",
              "versionType": "git"
            },
            {
              "lessThan": "91f90b571f1a23f5b8a9c2b68a9aa5d6981a3c3d",
              "status": "affected",
              "version": "0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf",
              "versionType": "git"
            },
            {
              "lessThan": "14602353b350950b551eccc6b46411aa3b12ffe2",
              "status": "affected",
              "version": "0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf",
              "versionType": "git"
            },
            {
              "lessThan": "725e00cb7039eae291890f1bb19bc867176745f6",
              "status": "affected",
              "version": "0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf",
              "versionType": "git"
            },
            {
              "lessThan": "ccc6639f831bee91aa8b41c8a1cdd020ecfb9f32",
              "status": "affected",
              "version": "0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf",
              "versionType": "git"
            },
            {
              "lessThan": "f87c7a4b084afc13190cbb263538e444cb2b392a",
              "status": "affected",
              "version": "0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/extents.c",
            "fs/ext4/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.8"
            },
            {
              "lessThan": "3.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.207",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.132",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.207",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.132",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.46",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.14",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.3",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix race condition between ext4_write and ext4_convert_inline_data\n\nHulk Robot reported a BUG_ON:\n ==================================================================\n EXT4-fs error (device loop3): ext4_mb_generate_buddy:805: group 0,\n block bitmap and bg descriptor inconsistent: 25 vs 31513 free clusters\n kernel BUG at fs/ext4/ext4_jbd2.c:53!\n invalid opcode: 0000 [#1] SMP KASAN PTI\n CPU: 0 PID: 25371 Comm: syz-executor.3 Not tainted 5.10.0+ #1\n RIP: 0010:ext4_put_nojournal fs/ext4/ext4_jbd2.c:53 [inline]\n RIP: 0010:__ext4_journal_stop+0x10e/0x110 fs/ext4/ext4_jbd2.c:116\n [...]\n Call Trace:\n  ext4_write_inline_data_end+0x59a/0x730 fs/ext4/inline.c:795\n  generic_perform_write+0x279/0x3c0 mm/filemap.c:3344\n  ext4_buffered_write_iter+0x2e3/0x3d0 fs/ext4/file.c:270\n  ext4_file_write_iter+0x30a/0x11c0 fs/ext4/file.c:520\n  do_iter_readv_writev+0x339/0x3c0 fs/read_write.c:732\n  do_iter_write+0x107/0x430 fs/read_write.c:861\n  vfs_writev fs/read_write.c:934 [inline]\n  do_pwritev+0x1e5/0x380 fs/read_write.c:1031\n [...]\n ==================================================================\n\nAbove issue may happen as follows:\n           cpu1                     cpu2\n__________________________|__________________________\ndo_pwritev\n vfs_writev\n  do_iter_write\n   ext4_file_write_iter\n    ext4_buffered_write_iter\n     generic_perform_write\n      ext4_da_write_begin\n                           vfs_fallocate\n                            ext4_fallocate\n                             ext4_convert_inline_data\n                              ext4_convert_inline_data_nolock\n                               ext4_destroy_inline_data_nolock\n                                clear EXT4_STATE_MAY_INLINE_DATA\n                               ext4_map_blocks\n                                ext4_ext_map_blocks\n                                 ext4_mb_new_blocks\n                                  ext4_mb_regular_allocator\n                                   ext4_mb_good_group_nolock\n                                    ext4_mb_init_group\n                                     ext4_mb_init_cache\n                                      ext4_mb_generate_buddy  --\u003e error\n       ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)\n                                ext4_restore_inline_data\n                                 set EXT4_STATE_MAY_INLINE_DATA\n       ext4_block_write_begin\n      ext4_da_write_end\n       ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)\n       ext4_write_inline_data_end\n        handle=NULL\n        ext4_journal_stop(handle)\n         __ext4_journal_stop\n          ext4_put_nojournal(handle)\n           ref_cnt = (unsigned long)handle\n           BUG_ON(ref_cnt == 0)  ---\u003e BUG_ON\n\nThe lock held by ext4_convert_inline_data is xattr_sem, but the lock\nheld by generic_perform_write is i_rwsem. Therefore, the two locks can\nbe concurrent.\n\nTo solve above issue, we add inode_lock() for ext4_convert_inline_data().\nAt the same time, move ext4_convert_inline_data() in front of\next4_punch_hole(), remove similar handling from ext4_punch_hole()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:59:21.432Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/18881d7e517169193d9ef6c89c7f322e3e164277"
        },
        {
          "url": "https://git.kernel.org/stable/c/91f90b571f1a23f5b8a9c2b68a9aa5d6981a3c3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/14602353b350950b551eccc6b46411aa3b12ffe2"
        },
        {
          "url": "https://git.kernel.org/stable/c/725e00cb7039eae291890f1bb19bc867176745f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/ccc6639f831bee91aa8b41c8a1cdd020ecfb9f32"
        },
        {
          "url": "https://git.kernel.org/stable/c/f87c7a4b084afc13190cbb263538e444cb2b392a"
        }
      ],
      "title": "ext4: fix race condition between ext4_write and ext4_convert_inline_data",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49414",
    "datePublished": "2025-02-26T02:12:35.083Z",
    "dateReserved": "2025-02-26T02:08:31.568Z",
    "dateUpdated": "2026-05-11T18:59:21.432Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49414",
      "date": "2026-09-19",
      "epss": "0.00189",
      "percentile": "0.0879"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ext4/extents.c",
                  "fs/ext4/inode.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "18881d7e517169193d9ef6c89c7f322e3e164277",
                    "status": "affected",
                    "version": "0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "91f90b571f1a23f5b8a9c2b68a9aa5d6981a3c3d",
                    "status": "affected",
                    "version": "0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "14602353b350950b551eccc6b46411aa3b12ffe2",
                    "status": "affected",
                    "version": "0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "725e00cb7039eae291890f1bb19bc867176745f6",
                    "status": "affected",
                    "version": "0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ccc6639f831bee91aa8b41c8a1cdd020ecfb9f32",
                    "status": "affected",
                    "version": "0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f87c7a4b084afc13190cbb263538e444cb2b392a",
                    "status": "affected",
                    "version": "0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ext4/extents.c",
                  "fs/ext4/inode.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.8"
                  },
                  {
                    "lessThan": "3.8",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.207",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.132",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.46",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.17.*",
                    "status": "unaffected",
                    "version": "5.17.14",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.18.*",
                    "status": "unaffected",
                    "version": "5.18.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.19",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "109BCDD7-33F8-40BE-B77A-E1C42BACBB08",
                    "versionEndExcluding": "5.4.207",
                    "versionStartIncluding": "3.8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "46CE9FE9-22E3-45CA-8B5F-190C2CAFC5CE",
                    "versionEndExcluding": "5.10.132",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "20D41697-0E8B-4B7D-8842-F17BF2AA21E1",
                    "versionEndExcluding": "5.15.46",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "15E2DD33-2255-4B76-9C15-04FF8CBAB252",
                    "versionEndExcluding": "5.17.14",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8E122216-2E9E-4B3E-B7B8-D575A45BA3C2",
                    "versionEndExcluding": "5.18.3",
                    "versionStartIncluding": "5.18",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix race condition between ext4_write and ext4_convert_inline_data\n\nHulk Robot reported a BUG_ON:\n ==================================================================\n EXT4-fs error (device loop3): ext4_mb_generate_buddy:805: group 0,\n block bitmap and bg descriptor inconsistent: 25 vs 31513 free clusters\n kernel BUG at fs/ext4/ext4_jbd2.c:53!\n invalid opcode: 0000 [#1] SMP KASAN PTI\n CPU: 0 PID: 25371 Comm: syz-executor.3 Not tainted 5.10.0+ #1\n RIP: 0010:ext4_put_nojournal fs/ext4/ext4_jbd2.c:53 [inline]\n RIP: 0010:__ext4_journal_stop+0x10e/0x110 fs/ext4/ext4_jbd2.c:116\n [...]\n Call Trace:\n  ext4_write_inline_data_end+0x59a/0x730 fs/ext4/inline.c:795\n  generic_perform_write+0x279/0x3c0 mm/filemap.c:3344\n  ext4_buffered_write_iter+0x2e3/0x3d0 fs/ext4/file.c:270\n  ext4_file_write_iter+0x30a/0x11c0 fs/ext4/file.c:520\n  do_iter_readv_writev+0x339/0x3c0 fs/read_write.c:732\n  do_iter_write+0x107/0x430 fs/read_write.c:861\n  vfs_writev fs/read_write.c:934 [inline]\n  do_pwritev+0x1e5/0x380 fs/read_write.c:1031\n [...]\n ==================================================================\n\nAbove issue may happen as follows:\n           cpu1                     cpu2\n__________________________|__________________________\ndo_pwritev\n vfs_writev\n  do_iter_write\n   ext4_file_write_iter\n    ext4_buffered_write_iter\n     generic_perform_write\n      ext4_da_write_begin\n                           vfs_fallocate\n                            ext4_fallocate\n                             ext4_convert_inline_data\n                              ext4_convert_inline_data_nolock\n                               ext4_destroy_inline_data_nolock\n                                clear EXT4_STATE_MAY_INLINE_DATA\n                               ext4_map_blocks\n                                ext4_ext_map_blocks\n                                 ext4_mb_new_blocks\n                                  ext4_mb_regular_allocator\n                                   ext4_mb_good_group_nolock\n                                    ext4_mb_init_group\n                                     ext4_mb_init_cache\n                                      ext4_mb_generate_buddy  --\u003e error\n       ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)\n                                ext4_restore_inline_data\n                                 set EXT4_STATE_MAY_INLINE_DATA\n       ext4_block_write_begin\n      ext4_da_write_end\n       ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)\n       ext4_write_inline_data_end\n        handle=NULL\n        ext4_journal_stop(handle)\n         __ext4_journal_stop\n          ext4_put_nojournal(handle)\n           ref_cnt = (unsigned long)handle\n           BUG_ON(ref_cnt == 0)  ---\u003e BUG_ON\n\nThe lock held by ext4_convert_inline_data is xattr_sem, but the lock\nheld by generic_perform_write is i_rwsem. Therefore, the two locks can\nbe concurrent.\n\nTo solve above issue, we add inode_lock() for ext4_convert_inline_data().\nAt the same time, move ext4_convert_inline_data() in front of\next4_punch_hole(), remove similar handling from ext4_punch_hole()."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ext4: se corrige la condici\u00f3n de ejecuci\u00f3n entre ext4_write y ext4_convert_inline_data Hulk Robot inform\u00f3 de un BUG_ON: ================================================================== EXT4-fs error (device loop3): ext4_mb_generate_buddy:805: group 0, block bitmap and bg descriptor inconsistent: 25 vs 31513 free clusters kernel BUG at fs/ext4/ext4_jbd2.c:53! invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 PID: 25371 Comm: syz-executor.3 Not tainted 5.10.0+ #1 RIP: 0010:ext4_put_nojournal fs/ext4/ext4_jbd2.c:53 [inline] RIP: 0010:__ext4_journal_stop+0x10e/0x110 fs/ext4/ext4_jbd2.c:116 [...] Call Trace: ext4_write_inline_data_end+0x59a/0x730 fs/ext4/inline.c:795 generic_perform_write+0x279/0x3c0 mm/filemap.c:3344 ext4_buffered_write_iter+0x2e3/0x3d0 fs/ext4/file.c:270 ext4_file_write_iter+0x30a/0x11c0 fs/ext4/file.c:520 do_iter_readv_writev+0x339/0x3c0 fs/read_write.c:732 do_iter_write+0x107/0x430 fs/read_write.c:861 vfs_writev fs/read_write.c:934 [inline] do_pwritev+0x1e5/0x380 fs/read_write.c:1031 [...] ================================================================== Above issue may happen as follows: cpu1 cpu2 __________________________|__________________________ do_pwritev vfs_writev do_iter_write ext4_file_write_iter ext4_buffered_write_iter generic_perform_write ext4_da_write_begin vfs_fallocate ext4_fallocate ext4_convert_inline_data ext4_convert_inline_data_nolock ext4_destroy_inline_data_nolock clear EXT4_STATE_MAY_INLINE_DATA ext4_map_blocks ext4_ext_map_blocks ext4_mb_new_blocks ext4_mb_regular_allocator ext4_mb_good_group_nolock ext4_mb_init_group ext4_mb_init_cache ext4_mb_generate_buddy --\u0026gt; error ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA) ext4_restore_inline_data set EXT4_STATE_MAY_INLINE_DATA ext4_block_write_begin ext4_da_write_end ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA) ext4_write_inline_data_end handle=NULL ext4_journal_stop(handle) __ext4_journal_stop ext4_put_nojournal(handle) ref_cnt = (unsigned long)handle BUG_ON(ref_cnt == 0) ---\u0026gt; BUG_ON The lock held by ext4_convert_inline_data is xattr_sem, but the lock held by generic_perform_write is i_rwsem. Therefore, the two locks can be concurrent. To solve above issue, we add inode_lock() for ext4_convert_inline_data(). At the same time, move ext4_convert_inline_data() in front of ext4_punch_hole(), remove similar handling from ext4_punch_hole(). "
          }
        ],
        "id": "CVE-2022-49414",
        "lastModified": "2026-06-17T05:17:58.980",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 4.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 4.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-49414",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:41:09.175529Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-02-26T07:01:17.890",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/14602353b350950b551eccc6b46411aa3b12ffe2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/18881d7e517169193d9ef6c89c7f322e3e164277"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/725e00cb7039eae291890f1bb19bc867176745f6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/91f90b571f1a23f5b8a9c2b68a9aa5d6981a3c3d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ccc6639f831bee91aa8b41c8a1cdd020ecfb9f32"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f87c7a4b084afc13190cbb263538e444cb2b392a"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-362"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-362"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T21:06:41+00:00",
      "cve": "CVE-2022-49414",
      "id": "CVE-2022-49414",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ext4: fix race condition between ext4_write and ext4_convert_inline_data",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49414.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T02:28:17Z",
      "cve": "CVE-2022-49414",
      "id": "CVE-2022-49414",
      "initial_release_date": "2025-02-27T03:07:18Z",
      "product_status:known_affected": "481",
      "product_status:known_not_affected": "170",
      "product_status:recommended": "333",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49414",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49414.json",
      "version": "80"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "HIGH",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 4.7,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-49414",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-01T19:41:09.175529Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-362",
                    "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-01T16:46:48.816Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "fs/ext4/extents.c",
                "fs/ext4/inode.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "18881d7e517169193d9ef6c89c7f322e3e164277",
                  "status": "affected",
                  "version": "0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf",
                  "versionType": "git"
                },
                {
                  "lessThan": "91f90b571f1a23f5b8a9c2b68a9aa5d6981a3c3d",
                  "status": "affected",
                  "version": "0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf",
                  "versionType": "git"
                },
                {
                  "lessThan": "14602353b350950b551eccc6b46411aa3b12ffe2",
                  "status": "affected",
                  "version": "0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf",
                  "versionType": "git"
                },
                {
                  "lessThan": "725e00cb7039eae291890f1bb19bc867176745f6",
                  "status": "affected",
                  "version": "0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf",
                  "versionType": "git"
                },
                {
                  "lessThan": "ccc6639f831bee91aa8b41c8a1cdd020ecfb9f32",
                  "status": "affected",
                  "version": "0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf",
                  "versionType": "git"
                },
                {
                  "lessThan": "f87c7a4b084afc13190cbb263538e444cb2b392a",
                  "status": "affected",
                  "version": "0c8d414f163f5d35e43a4de7a6e5ee8c253fcccf",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "fs/ext4/extents.c",
                "fs/ext4/inode.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "3.8"
                },
                {
                  "lessThan": "3.8",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.207",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.132",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.46",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.17.*",
                  "status": "unaffected",
                  "version": "5.17.14",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.18.*",
                  "status": "unaffected",
                  "version": "5.18.3",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.19",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.207",
                      "versionStartIncluding": "3.8",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.132",
                      "versionStartIncluding": "3.8",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.46",
                      "versionStartIncluding": "3.8",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.17.14",
                      "versionStartIncluding": "3.8",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.18.3",
                      "versionStartIncluding": "3.8",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.19",
                      "versionStartIncluding": "3.8",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix race condition between ext4_write and ext4_convert_inline_data\n\nHulk Robot reported a BUG_ON:\n ==================================================================\n EXT4-fs error (device loop3): ext4_mb_generate_buddy:805: group 0,\n block bitmap and bg descriptor inconsistent: 25 vs 31513 free clusters\n kernel BUG at fs/ext4/ext4_jbd2.c:53!\n invalid opcode: 0000 [#1] SMP KASAN PTI\n CPU: 0 PID: 25371 Comm: syz-executor.3 Not tainted 5.10.0+ #1\n RIP: 0010:ext4_put_nojournal fs/ext4/ext4_jbd2.c:53 [inline]\n RIP: 0010:__ext4_journal_stop+0x10e/0x110 fs/ext4/ext4_jbd2.c:116\n [...]\n Call Trace:\n  ext4_write_inline_data_end+0x59a/0x730 fs/ext4/inline.c:795\n  generic_perform_write+0x279/0x3c0 mm/filemap.c:3344\n  ext4_buffered_write_iter+0x2e3/0x3d0 fs/ext4/file.c:270\n  ext4_file_write_iter+0x30a/0x11c0 fs/ext4/file.c:520\n  do_iter_readv_writev+0x339/0x3c0 fs/read_write.c:732\n  do_iter_write+0x107/0x430 fs/read_write.c:861\n  vfs_writev fs/read_write.c:934 [inline]\n  do_pwritev+0x1e5/0x380 fs/read_write.c:1031\n [...]\n ==================================================================\n\nAbove issue may happen as follows:\n           cpu1                     cpu2\n__________________________|__________________________\ndo_pwritev\n vfs_writev\n  do_iter_write\n   ext4_file_write_iter\n    ext4_buffered_write_iter\n     generic_perform_write\n      ext4_da_write_begin\n                           vfs_fallocate\n                            ext4_fallocate\n                             ext4_convert_inline_data\n                              ext4_convert_inline_data_nolock\n                               ext4_destroy_inline_data_nolock\n                                clear EXT4_STATE_MAY_INLINE_DATA\n                               ext4_map_blocks\n                                ext4_ext_map_blocks\n                                 ext4_mb_new_blocks\n                                  ext4_mb_regular_allocator\n                                   ext4_mb_good_group_nolock\n                                    ext4_mb_init_group\n                                     ext4_mb_init_cache\n                                      ext4_mb_generate_buddy  --\u003e error\n       ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)\n                                ext4_restore_inline_data\n                                 set EXT4_STATE_MAY_INLINE_DATA\n       ext4_block_write_begin\n      ext4_da_write_end\n       ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)\n       ext4_write_inline_data_end\n        handle=NULL\n        ext4_journal_stop(handle)\n         __ext4_journal_stop\n          ext4_put_nojournal(handle)\n           ref_cnt = (unsigned long)handle\n           BUG_ON(ref_cnt == 0)  ---\u003e BUG_ON\n\nThe lock held by ext4_convert_inline_data is xattr_sem, but the lock\nheld by generic_perform_write is i_rwsem. Therefore, the two locks can\nbe concurrent.\n\nTo solve above issue, we add inode_lock() for ext4_convert_inline_data().\nAt the same time, move ext4_convert_inline_data() in front of\next4_punch_hole(), remove similar handling from ext4_punch_hole()."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-11T18:59:21.432Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/18881d7e517169193d9ef6c89c7f322e3e164277"
            },
            {
              "url": "https://git.kernel.org/stable/c/91f90b571f1a23f5b8a9c2b68a9aa5d6981a3c3d"
            },
            {
              "url": "https://git.kernel.org/stable/c/14602353b350950b551eccc6b46411aa3b12ffe2"
            },
            {
              "url": "https://git.kernel.org/stable/c/725e00cb7039eae291890f1bb19bc867176745f6"
            },
            {
              "url": "https://git.kernel.org/stable/c/ccc6639f831bee91aa8b41c8a1cdd020ecfb9f32"
            },
            {
              "url": "https://git.kernel.org/stable/c/f87c7a4b084afc13190cbb263538e444cb2b392a"
            }
          ],
          "title": "ext4: fix race condition between ext4_write and ext4_convert_inline_data",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2022-49414",
        "datePublished": "2025-02-26T02:12:35.083Z",
        "dateReserved": "2025-02-26T02:08:31.568Z",
        "dateUpdated": "2026-05-11T18:59:21.432Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.