PT-2025-25935 · Linux+1 · Linux Kernel+1

Published 2022-08-01 · Updated 2026-04-20 · CVE-2022-50009

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.19.0-rc6-next-20220715

Description A null pointer dereference issue was found in the f2fs get dnode of data function. This issue occurs when testing f2fs atomic write, resulting in errors such as "Can't find valid F2FS filesystem in 2th superblock" and "invalid crc offset: 0". The problem arises from the introduction of a new atomic write way, which creates a cow inode for atomic write files and marks it as FI ATOMIC FILE. When f2fs do write data page writes to the cow inode, it uses the cow inode's cow inode, which is NULL, triggering a null pointer dereference.

Recommendations To solve this issue, introduce the FI COW FILE flag for COW inodes. For Linux kernel versions prior to 5.19.0-rc6-next-20220715, apply the fix introduced in commit 3db1de0e582c, which changes the current atomic write way.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2026-04502

CVE-2022-50009

Affected Products

Debian

Linux Kernel

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50009.json · Exploit
• https://git.kernel.org/stable/c/4a2c5b7994960fac29cf8a3f4e62855bae1b27d4 · Patch
• https://git.kernel.org/stable/c/0f63e33eca6fa29a11c76fa31db5fe1cada5ad6e · Patch
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2022-50009 · Vendor Advisory
• https://git.kernel.org/stable/c/7000ad53ec1b17bd2fac76984b7b0c663755cbb7 · Patch
• https://bdu.fstec.ru/vul/2026-04502 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-50009 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-50009 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-50009 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2022-50009 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-50009 · Security Note
• https://ubuntu.com/security/CVE-2022-50009 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-50009 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-50009 · Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note