{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2022-50346", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2022-50346", "idYear": 2022, "status": "PUBLISHED", "publishedAt": "2025-09-16T16:11:39.179Z", "updatedAt": "2026-05-11T19:17:45.342Z", "importedAt": "2026-10-24T01:56:49.724Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "ext4: init quota for 'old.inode' in 'ext4_rename'", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: init quota for 'old.inode' in 'ext4_rename'\n\nSyzbot found the following issue:\next4_parse_param: s_want_extra_isize=128\next4_inode_info_init: s_want_extra_isize=32\next4_rename: old.inode=ffff88823869a2c8 old.dir=ffff888238699828 new.inode=ffff88823869d7e8 new.dir=ffff888238699828\n__ext4_mark_inode_dirty: inode=ffff888238699828 ea_isize=32 want_ea_size=128\n__ext4_mark_inode_dirty: inode=ffff88823869a2c8 ea_isize=32 want_ea_size=128\next4_xattr_block_set: inode=ffff88823869a2c8\n------------[ cut here ]------------\nWARNING: CPU: 13 PID: 2234 at fs/ext4/xattr.c:2070 ext4_xattr_block_set.cold+0x22/0x980\nModules linked in:\nRIP: 0010:ext4_xattr_block_set.cold+0x22/0x980\nRSP: 0018:ffff888227d3f3b0 EFLAGS: 00010202\nRAX: 0000000000000001 RBX: ffff88823007a000 RCX: 0000000000000000\nRDX: 0000000000000a03 RSI: 0000000000000040 RDI: ffff888230078178\nRBP: 0000000000000000 R08: 000000000000002c R09: ffffed1075c7df8e\nR10: ffff8883ae3efc6b R11: ffffed1075c7df8d R12: 0000000000000000\nR13: ffff88823869a2c8 R14: ffff8881012e0460 R15: dffffc0000000000\nFS: 00007f350ac1f740(0000) GS:ffff8883ae200000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f350a6ed6a0 CR3: 0000000237456000 CR4: 00000000000006e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \n ? ext4_xattr_set_entry+0x3b7/0x2320\n ? ext4_xattr_block_set+0x0/0x2020\n ? ext4_xattr_set_entry+0x0/0x2320\n ? ext4_xattr_check_entries+0x77/0x310\n ? ext4_xattr_ibody_set+0x23b/0x340\n ext4_xattr_move_to_block+0x594/0x720\n ext4_expand_extra_isize_ea+0x59a/0x10f0\n __ext4_expand_extra_isize+0x278/0x3f0\n __ext4_mark_inode_dirty.cold+0x347/0x410\n ext4_rename+0xed3/0x174f\n vfs_rename+0x13a7/0x2510\n do_renameat2+0x55d/0x920\n __x64_sys_rename+0x7d/0xb0\n do_syscall_64+0x3b/0xa0\n entry_SYSCALL_64_after_hwframe+0x72/0xdc\n\nAs 'ext4_rename' will modify 'old.inode' ctime and mark inode dirty,\nwhich may trigger expand 'extra_isize' and allocate block. If inode\ndidn't init quota will lead to warning. To solve above issue, init\n'old.inode' firstly in 'ext4_rename'.", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "6dd4ee7cab7e3a17c571aebd444f4344c8c4946e", "status": "affected", "versionType": "git", "lessThan": "67f6d5a4043f3db0c6bb0e14a0d97a7be8bfb8b5" }, { "version": "6dd4ee7cab7e3a17c571aebd444f4344c8c4946e", "status": "affected", "versionType": "git", "lessThan": "33fd7031d634f3b46e59f61adfbb0ea9fe514fef" }, { "version": "6dd4ee7cab7e3a17c571aebd444f4344c8c4946e", "status": "affected", "versionType": "git", "lessThan": "7dfb8259f66faafa68d23a261b284d2c2c67649b" }, { "version": "6dd4ee7cab7e3a17c571aebd444f4344c8c4946e", "status": "affected", "versionType": "git", "lessThan": "f263e349bacc2f303526dcfa61c4bc50132418b1" }, { "version": "6dd4ee7cab7e3a17c571aebd444f4344c8c4946e", "status": "affected", "versionType": "git", "lessThan": "84a2f2ed49d6a4d92b354219077434c57d334620" }, { "version": "6dd4ee7cab7e3a17c571aebd444f4344c8c4946e", "status": "affected", "versionType": "git", "lessThan": "def7a39091e60e1c4a2f623629082a00092602be" }, { "version": "6dd4ee7cab7e3a17c571aebd444f4344c8c4946e", "status": "affected", "versionType": "git", "lessThan": "135ba9146f4d38abed48a540ef8a8770ff0bd34f" }, { "version": "6dd4ee7cab7e3a17c571aebd444f4344c8c4946e", "status": "affected", "versionType": "git", "lessThan": "13271fbbe85d73a7c47058f56a52f2a7f00d6e39" }, { "version": "6dd4ee7cab7e3a17c571aebd444f4344c8c4946e", "status": "affected", "versionType": "git", "lessThan": "fae381a3d79bb94aa2eb752170d47458d778b797" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "2.6.23", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "2.6.23" }, { "version": "4.9.337", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "4.9.*" }, { "version": "4.14.303", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "4.14.*" }, { "version": "4.19.270", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "4.19.*" }, { "version": "5.4.229", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.4.*" }, { "version": "5.10.163", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.10.*" }, { "version": "5.15.87", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.15.*" }, { "version": "6.0.18", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.0.*" }, { "version": "6.1.4", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.1.*" }, { "version": "6.2", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }