{"id":"DEBIAN-CVE-2022-50673","details":"In the Linux kernel, the following vulnerability has been resolved:  ext4: fix use-after-free in ext4_orphan_cleanup  I caught a issue as follows: ==================================================================  BUG: KASAN: use-after-free in __list_add_valid+0x28/0x1a0  Read of size 8 at addr ffff88814b13f378 by task mount/710   CPU: 1 PID: 710 Comm: mount Not tainted 6.1.0-rc3-next #370  Call Trace:   \u003cTASK\u003e   dump_stack_lvl+0x73/0x9f   print_report+0x25d/0x759   kasan_report+0xc0/0x120   __asan_load8+0x99/0x140   __list_add_valid+0x28/0x1a0   ext4_orphan_cleanup+0x564/0x9d0 [ext4]   __ext4_fill_super+0x48e2/0x5300 [ext4]   ext4_fill_super+0x19f/0x3a0 [ext4]   get_tree_bdev+0x27b/0x450   ext4_get_tree+0x19/0x30 [ext4]   vfs_get_tree+0x49/0x150   path_mount+0xaae/0x1350   do_mount+0xe2/0x110   __x64_sys_mount+0xf0/0x190   do_syscall_64+0x35/0x80   entry_SYSCALL_64_after_hwframe+0x63/0xcd   \u003c/TASK\u003e  [...] ==================================================================  Above issue may happen as follows: ------------------------------------- ext4_fill_super   ext4_orphan_cleanup    --- loop1: assume last_orphan is 12 ---     list_add(&EXT4_I(inode)-\u003ei_orphan, &EXT4_SB(sb)-\u003es_orphan)     ext4_truncate --\u003e return 0       ext4_inode_attach_jinode --\u003e return -ENOMEM     iput(inode) --\u003e free inode\u003c12\u003e    --- loop2: last_orphan is still 12 ---     list_add(&EXT4_I(inode)-\u003ei_orphan, &EXT4_SB(sb)-\u003es_orphan);     // use inode\u003c12\u003e and trigger UAF  To solve this issue, we need to propagate the return value of ext4_inode_attach_jinode() appropriately.","modified":"2026-08-05T09:01:12.124341651Z","published":"2025-12-09T16:17:19.473Z","upstream":["CVE-2022-50673"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2022-50673"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:11","purl":"pkg:deb/debian/linux?arch=source&distro=bullseye"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.178-1"}]}],"versions":["5.10.103-1","5.10.103-1~bpo10+1","5.10.106-1","5.10.113-1","5.10.120-1","5.10.120-1~bpo10+1","5.10.127-1","5.10.127-2","5.10.127-2~bpo10+1","5.10.136-1","5.10.140-1","5.10.148-1","5.10.149-1","5.10.149-2","5.10.158-1","5.10.158-2","5.10.162-1","5.10.46-4","5.10.46-5","5.10.70-1","5.10.70-1~bpo10+1","5.10.84-1","5.10.92-1","5.10.92-1~bpo10+1","5.10.92-2"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50673.json"}},{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50673.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50673.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50673.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}