{"id":"CVE-2022-50346","summary":"ext4: init quota for 'old.inode' in 'ext4_rename'","details":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: init quota for 'old.inode' in 'ext4_rename'\n\nSyzbot found the following issue:\next4_parse_param: s_want_extra_isize=128\next4_inode_info_init: s_want_extra_isize=32\next4_rename: old.inode=ffff88823869a2c8 old.dir=ffff888238699828 new.inode=ffff88823869d7e8 new.dir=ffff888238699828\n__ext4_mark_inode_dirty: inode=ffff888238699828 ea_isize=32 want_ea_size=128\n__ext4_mark_inode_dirty: inode=ffff88823869a2c8 ea_isize=32 want_ea_size=128\next4_xattr_block_set: inode=ffff88823869a2c8\n------------[ cut here ]------------\nWARNING: CPU: 13 PID: 2234 at fs/ext4/xattr.c:2070 ext4_xattr_block_set.cold+0x22/0x980\nModules linked in:\nRIP: 0010:ext4_xattr_block_set.cold+0x22/0x980\nRSP: 0018:ffff888227d3f3b0 EFLAGS: 00010202\nRAX: 0000000000000001 RBX: ffff88823007a000 RCX: 0000000000000000\nRDX: 0000000000000a03 RSI: 0000000000000040 RDI: ffff888230078178\nRBP: 0000000000000000 R08: 000000000000002c R09: ffffed1075c7df8e\nR10: ffff8883ae3efc6b R11: ffffed1075c7df8d R12: 0000000000000000\nR13: ffff88823869a2c8 R14: ffff8881012e0460 R15: dffffc0000000000\nFS:  00007f350ac1f740(0000) GS:ffff8883ae200000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f350a6ed6a0 CR3: 0000000237456000 CR4: 00000000000006e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n ? ext4_xattr_set_entry+0x3b7/0x2320\n ? ext4_xattr_block_set+0x0/0x2020\n ? ext4_xattr_set_entry+0x0/0x2320\n ? ext4_xattr_check_entries+0x77/0x310\n ? ext4_xattr_ibody_set+0x23b/0x340\n ext4_xattr_move_to_block+0x594/0x720\n ext4_expand_extra_isize_ea+0x59a/0x10f0\n __ext4_expand_extra_isize+0x278/0x3f0\n __ext4_mark_inode_dirty.cold+0x347/0x410\n ext4_rename+0xed3/0x174f\n vfs_rename+0x13a7/0x2510\n do_renameat2+0x55d/0x920\n __x64_sys_rename+0x7d/0xb0\n do_syscall_64+0x3b/0xa0\n entry_SYSCALL_64_after_hwframe+0x72/0xdc\n\nAs 'ext4_rename' will modify 'old.inode' ctime and mark inode dirty,\nwhich may trigger expand 'extra_isize' and allocate block. If inode\ndidn't init quota will lead to warning.  To solve above issue, init\n'old.inode' firstly in 'ext4_rename'.","modified":"2026-04-02T08:28:25.761975Z","published":"2025-09-16T16:11:39.179Z","related":["SUSE-SU-2025:03614-1","SUSE-SU-2025:03615-1","SUSE-SU-2025:03628-1","SUSE-SU-2025:3716-1","SUSE-SU-2025:3761-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50346.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/13271fbbe85d73a7c47058f56a52f2a7f00d6e39"},{"type":"WEB","url":"https://git.kernel.org/stable/c/135ba9146f4d38abed48a540ef8a8770ff0bd34f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/33fd7031d634f3b46e59f61adfbb0ea9fe514fef"},{"type":"WEB","url":"https://git.kernel.org/stable/c/67f6d5a4043f3db0c6bb0e14a0d97a7be8bfb8b5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7dfb8259f66faafa68d23a261b284d2c2c67649b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/84a2f2ed49d6a4d92b354219077434c57d334620"},{"type":"WEB","url":"https://git.kernel.org/stable/c/def7a39091e60e1c4a2f623629082a00092602be"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f263e349bacc2f303526dcfa61c4bc50132418b1"},{"type":"WEB","url":"https://git.kernel.org/stable/c/fae381a3d79bb94aa2eb752170d47458d778b797"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50346.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-50346"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6dd4ee7cab7e3a17c571aebd444f4344c8c4946e"},{"fixed":"67f6d5a4043f3db0c6bb0e14a0d97a7be8bfb8b5"},{"fixed":"33fd7031d634f3b46e59f61adfbb0ea9fe514fef"},{"fixed":"7dfb8259f66faafa68d23a261b284d2c2c67649b"},{"fixed":"f263e349bacc2f303526dcfa61c4bc50132418b1"},{"fixed":"84a2f2ed49d6a4d92b354219077434c57d334620"},{"fixed":"def7a39091e60e1c4a2f623629082a00092602be"},{"fixed":"135ba9146f4d38abed48a540ef8a8770ff0bd34f"},{"fixed":"13271fbbe85d73a7c47058f56a52f2a7f00d6e39"},{"fixed":"fae381a3d79bb94aa2eb752170d47458d778b797"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50346.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}