PT-2025-8102 · Linux+2 · Linux Kernel+2

Ritesh Harjani · Published 2022-02-25 · Updated 2025-04-14 · CVE-2022-49174

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been identified, specifically in the ext4 file system. The issue arises when the flex bg feature is enabled, which is the default setting. In this scenario, extents for a given inode may span across blocks from two different block groups. The function ext4 mb mark bb() fails to read the block bitmap again when the extent length boundary overflows to another block group, resulting in a data abort. This can lead to inconsistent block bitmap and bg descriptor free clusters, causing the file system to shut down. The vulnerability can be exploited to cause a data access abort.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

BDU:2026-02208

CVE-2022-49174

SUSE-SU-2025:1027-1

SUSE-SU-2025:1176-1

SUSE-SU-2025:1183-1

SUSE-SU-2025:1241-1

SUSE-SU-2025_1027-1

SUSE-SU-2025_1241-1

Affected Products

Astra Linux

Linux Kernel

Suse

References · 1336

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49174.json · Exploit
• https://git.kernel.org/stable/c/6a6beb074186a0452368a023a261c7d0eaebe838 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1027-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49174 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49174 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-49174 · Vendor Advisory
• https://git.kernel.org/stable/c/cd6d719534af993210306f8a13f9cb3e615f7c8d · Patch
• https://osv.dev/vulnerability/CVE-2022-49174 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-49174 · Vendor Advisory
• https://git.kernel.org/stable/c/803fb0e8240cc16585a5c9df76add1dfaa781773 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49174 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:1241-1 · Vendor Advisory
• https://git.kernel.org/stable/c/b07eedd0222e9548ffc568ec429bb1f61d21a39c · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1176-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49174 · Security Note