PT-2025-25947 · Linux+3 · Linux Kernel+3

Published 2022-08-02 · Updated 2025-07-28 · CVE-2022-50021

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.19.0-rc6+

Description A vulnerability in the Linux kernel has been identified where the block range is not properly validated before use in ext4 mb clear bb(), potentially leading to issues on corrupted file systems. This can cause a kernel bug, as seen in a case found by syzkaller, resulting in a crash. The vulnerability is related to the ext4 file system, specifically when using bigalloc.

Recommendations For Linux kernel versions prior to 5.19.0-rc6+, update to a version that includes the fix for the block range validation issue in ext4 mb clear bb(). As a temporary workaround, consider disabling the use of bigalloc on ext4 file systems until a patch is available. Restrict access to the ext4 free blocks() and ext4 mb clear bb() functions to minimize the risk of exploitation. Avoid using the affected ext4 file system features until the issue is resolved.

Exploit

Fix

Improper Initialization

Use After Free

Weakness Enumeration

CWE-665

CWE-416

Related Identifiers

BDU:2026-01521

CVE-2022-50021

RHSA-2023:2458

RHSA-2023_2458

SUSE-SU-2025:02264-1

SUSE-SU-2025:02321-1

SUSE-SU-2025:02322-1

SUSE-SU-2025:02537-1

SUSE-SU-2025:2264-1

SUSE-SU-2025_02264-1

SUSE-SU-2025_02537-1

Affected Products

Astra Linux

Linux Kernel

Red Hat

Suse

References · 594

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50021.json · Exploit
• https://cve.org/CVERecord?id=CVE-2022-50021 · Security Note
• https://git.kernel.org/stable/c/7550aade978371ac582f6d43b14c4cb89ca54463 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-50021 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-50021 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01521 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-50021 · Vendor Advisory
• https://git.kernel.org/stable/c/a2522041d248a8c969cbbc97e1fc2cd8b4de120d · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:02537-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-50021 · Vendor Advisory
• https://git.kernel.org/stable/c/1e1c2b86ef86a8477fd9b9a4f48a6bfe235606f6 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-50021 · Vendor Advisory
• https://git.kernel.org/stable/c/560a2744cbbf03cac65a6394f9b0d99aa437c867 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:02321-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-50021 · Vendor Advisory