GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49879 (GCVE-0-2022-49879)

Vulnerability from cvelistv5 – Published: 2025-05-01 14:10 – Updated: 2026-05-11 19:08
VLAI
Title
ext4: fix BUG_ON() when directory entry has invalid rec_len
Summary
In the Linux kernel, the following vulnerability has been resolved: ext4: fix BUG_ON() when directory entry has invalid rec_len The rec_len field in the directory entry has to be a multiple of 4. A corrupted filesystem image can be used to hit a BUG() in ext4_rec_len_to_disk(), called from make_indexed_dir(). ------------[ cut here ]------------ kernel BUG at fs/ext4/ext4.h:2413! ... RIP: 0010:make_indexed_dir+0x53f/0x5f0 ... Call Trace: <TASK> ? add_dirent_to_buf+0x1b2/0x200 ext4_add_entry+0x36e/0x480 ext4_add_nondir+0x2b/0xc0 ext4_create+0x163/0x200 path_openat+0x635/0xe90 do_filp_open+0xb4/0x160 ? __create_object.isra.0+0x1de/0x3b0 ? _raw_spin_unlock+0x12/0x30 do_sys_openat2+0x91/0x150 __x64_sys_open+0x6c/0xa0 do_syscall_64+0x3c/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The fix simply adds a call to ext4_check_dir_entry() to validate the directory entry, returning -EFSCORRUPTED if the entry is invalid.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3d0518f4758eca4339e75e5b9dbb7e06a5ce08b4 , < 2fa24d0274fbf913b56ee31f15bc01168669d909 (git)
Affected: 3d0518f4758eca4339e75e5b9dbb7e06a5ce08b4 , < 156451a67b93986fb07c274ef6995ff40766c5ad (git)
Affected: 3d0518f4758eca4339e75e5b9dbb7e06a5ce08b4 , < 999cff2b6ce3b45c08abf793bf55534777421327 (git)
Affected: 3d0518f4758eca4339e75e5b9dbb7e06a5ce08b4 , < ce1ee2c8827fb6493e91acbd50f664cf2a972c3d (git)
Affected: 3d0518f4758eca4339e75e5b9dbb7e06a5ce08b4 , < 17a0bc9bd697f75cfdf9b378d5eb2d7409c91340 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.30
Unaffected: 0 , < 2.6.30 (semver)
Unaffected: 5.4.224 , ≤ 5.4.* (semver)
Unaffected: 5.10.154 , ≤ 5.10.* (semver)
Unaffected: 5.15.78 , ≤ 5.15.* (semver)
Unaffected: 6.0.8 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2fa24d0274fbf913b56ee31f15bc01168669d909",
              "status": "affected",
              "version": "3d0518f4758eca4339e75e5b9dbb7e06a5ce08b4",
              "versionType": "git"
            },
            {
              "lessThan": "156451a67b93986fb07c274ef6995ff40766c5ad",
              "status": "affected",
              "version": "3d0518f4758eca4339e75e5b9dbb7e06a5ce08b4",
              "versionType": "git"
            },
            {
              "lessThan": "999cff2b6ce3b45c08abf793bf55534777421327",
              "status": "affected",
              "version": "3d0518f4758eca4339e75e5b9dbb7e06a5ce08b4",
              "versionType": "git"
            },
            {
              "lessThan": "ce1ee2c8827fb6493e91acbd50f664cf2a972c3d",
              "status": "affected",
              "version": "3d0518f4758eca4339e75e5b9dbb7e06a5ce08b4",
              "versionType": "git"
            },
            {
              "lessThan": "17a0bc9bd697f75cfdf9b378d5eb2d7409c91340",
              "status": "affected",
              "version": "3d0518f4758eca4339e75e5b9dbb7e06a5ce08b4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.30"
            },
            {
              "lessThan": "2.6.30",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.224",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.154",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.78",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.8",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix BUG_ON() when directory entry has invalid rec_len\n\nThe rec_len field in the directory entry has to be a multiple of 4.  A\ncorrupted filesystem image can be used to hit a BUG() in\next4_rec_len_to_disk(), called from make_indexed_dir().\n\n ------------[ cut here ]------------\n kernel BUG at fs/ext4/ext4.h:2413!\n ...\n RIP: 0010:make_indexed_dir+0x53f/0x5f0\n ...\n Call Trace:\n  \u003cTASK\u003e\n  ? add_dirent_to_buf+0x1b2/0x200\n  ext4_add_entry+0x36e/0x480\n  ext4_add_nondir+0x2b/0xc0\n  ext4_create+0x163/0x200\n  path_openat+0x635/0xe90\n  do_filp_open+0xb4/0x160\n  ? __create_object.isra.0+0x1de/0x3b0\n  ? _raw_spin_unlock+0x12/0x30\n  do_sys_openat2+0x91/0x150\n  __x64_sys_open+0x6c/0xa0\n  do_syscall_64+0x3c/0x80\n  entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nThe fix simply adds a call to ext4_check_dir_entry() to validate the\ndirectory entry, returning -EFSCORRUPTED if the entry is invalid."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:08:30.756Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2fa24d0274fbf913b56ee31f15bc01168669d909"
        },
        {
          "url": "https://git.kernel.org/stable/c/156451a67b93986fb07c274ef6995ff40766c5ad"
        },
        {
          "url": "https://git.kernel.org/stable/c/999cff2b6ce3b45c08abf793bf55534777421327"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce1ee2c8827fb6493e91acbd50f664cf2a972c3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/17a0bc9bd697f75cfdf9b378d5eb2d7409c91340"
        }
      ],
      "title": "ext4: fix BUG_ON() when directory entry has invalid rec_len",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49879",
    "datePublished": "2025-05-01T14:10:27.117Z",
    "dateReserved": "2025-05-01T14:05:17.239Z",
    "dateUpdated": "2026-05-11T19:08:30.756Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49879",
      "date": "2026-09-16",
      "epss": "0.00211",
      "percentile": "0.11529"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49879\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-01T15:16:12.857\",\"lastModified\":\"2026-06-17T05:19:24.190\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\next4: fix BUG_ON() when directory entry has invalid rec_len\\n\\nThe rec_len field in the directory entry has to be a multiple of 4.  A\\ncorrupted filesystem image can be used to hit a BUG() in\\next4_rec_len_to_disk(), called from make_indexed_dir().\\n\\n ------------[ cut here ]------------\\n kernel BUG at fs/ext4/ext4.h:2413!\\n ...\\n RIP: 0010:make_indexed_dir+0x53f/0x5f0\\n ...\\n Call Trace:\\n  \u003cTASK\u003e\\n  ? add_dirent_to_buf+0x1b2/0x200\\n  ext4_add_entry+0x36e/0x480\\n  ext4_add_nondir+0x2b/0xc0\\n  ext4_create+0x163/0x200\\n  path_openat+0x635/0xe90\\n  do_filp_open+0xb4/0x160\\n  ? __create_object.isra.0+0x1de/0x3b0\\n  ? _raw_spin_unlock+0x12/0x30\\n  do_sys_openat2+0x91/0x150\\n  __x64_sys_open+0x6c/0xa0\\n  do_syscall_64+0x3c/0x80\\n  entry_SYSCALL_64_after_hwframe+0x46/0xb0\\n\\nThe fix simply adds a call to ext4_check_dir_entry() to validate the\\ndirectory entry, returning -EFSCORRUPTED if the entry is invalid.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ext4: correcci\u00f3n de BUG_ON() cuando la entrada de directorio tiene un rec_len no v\u00e1lido El campo rec_len en la entrada de directorio debe ser un m\u00faltiplo de 4. Una imagen de sistema de archivos da\u00f1ada se puede usar para generar un BUG() en ext4_rec_len_to_disk(), llamado desde make_indexed_dir(). ------------[ cortar aqu\u00ed ]------------ \u00a1ERROR del kernel en fs/ext4/ext4.h:2413! ... RIP: 0010:make_indexed_dir+0x53f/0x5f0 ... Rastreo de llamadas:   ? add_dirent_to_buf+0x1b2/0x200 ext4_add_entry+0x36e/0x480 ext4_add_nondir+0x2b/0xc0 ext4_create+0x163/0x200 path_openat+0x635/0xe90 do_filp_open+0xb4/0x160 ? __create_object.isra.0+0x1de/0x3b0 ? _raw_spin_unlock+0x12/0x30 do_sys_openat2+0x91/0x150 __x64_sys_open+0x6c/0xa0 do_syscall_64+0x3c/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 La soluci\u00f3n simplemente agrega una llamada a ext4_check_dir_entry() para validar la entrada del directorio, devolviendo -EFSCORRUPTED si la entrada no es v\u00e1lida.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ext4/namei.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3d0518f4758eca4339e75e5b9dbb7e06a5ce08b4\",\"lessThan\":\"2fa24d0274fbf913b56ee31f15bc01168669d909\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3d0518f4758eca4339e75e5b9dbb7e06a5ce08b4\",\"lessThan\":\"156451a67b93986fb07c274ef6995ff40766c5ad\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3d0518f4758eca4339e75e5b9dbb7e06a5ce08b4\",\"lessThan\":\"999cff2b6ce3b45c08abf793bf55534777421327\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3d0518f4758eca4339e75e5b9dbb7e06a5ce08b4\",\"lessThan\":\"ce1ee2c8827fb6493e91acbd50f664cf2a972c3d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3d0518f4758eca4339e75e5b9dbb7e06a5ce08b4\",\"lessThan\":\"17a0bc9bd697f75cfdf9b378d5eb2d7409c91340\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ext4/namei.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.30\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.30\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.224\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.154\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.78\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0.8\",\"lessThanOrEqual\":\"6.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-617\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.4.224\",\"matchCriteriaId\":\"1A06F3FB-68BF-4D02-8B97-06AB86DC13A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.154\",\"matchCriteriaId\":\"475D097C-AB5A-4CF5-899F-413077854ABD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.78\",\"matchCriteriaId\":\"AB8B27B9-B41B-42D5-AE67-0A89A8A8EEB1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.0.8\",\"matchCriteriaId\":\"EC9A754E-625D-42F3-87A7-960D643E2867\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E7E331DA-1FB0-4DEC-91AC-7DA69D461C11\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"17F0B248-42CF-4AE6-A469-BB1BAE7F4705\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E2422816-0C14-4B5E-A1E6-A9D776E5C49B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/156451a67b93986fb07c274ef6995ff40766c5ad\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/17a0bc9bd697f75cfdf9b378d5eb2d7409c91340\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2fa24d0274fbf913b56ee31f15bc01168669d909\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/999cff2b6ce3b45c08abf793bf55534777421327\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ce1ee2c8827fb6493e91acbd50f664cf2a972c3d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T21:29:23+00:00",
      "cve": "CVE-2022-49879",
      "id": "CVE-2022-49879",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ext4: fix BUG_ON() when directory entry has invalid rec_len",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49879.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T01:28:25Z",
      "cve": "CVE-2022-49879",
      "id": "CVE-2022-49879",
      "initial_release_date": "2025-05-09T04:54:50Z",
      "product_status:known_affected": "496",
      "product_status:known_not_affected": "152",
      "product_status:recommended": "318",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49879",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49879.json",
      "version": "57"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.