{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-50306","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-09-15T14:18:36.813Z","datePublished":"2025-09-15T14:46:01.672Z","dateUpdated":"2026-08-05T08:58:07.756Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T08:58:07.756Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix potential out of bound read in ext4_fc_replay_scan()\n\nFor scan loop must ensure that at least EXT4_FC_TAG_BASE_LEN space. If remain\nspace less than EXT4_FC_TAG_BASE_LEN which will lead to out of bound read\nwhen mounting corrupt file system image.\nADD_RANGE/HEAD/TAIL is needed to add extra check when do journal scan, as this\nthree tags will read data during scan, tag length couldn't less than data length\nwhich will read."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Triggered only when mounting a crafted ext4 image with a dirty fast-commit journal; the path is local VFS mount → jbd2_journal_load → fc_do_one_pass → ext4_fc_replay_scan(), not reachable via network packet processing.\nAC:L - The attacker fully controls the on-disk fast-commit tags, lengths, and journal dirty state in the image, so the OOB read is reliably triggered on mount with no conditions outside their control.\nPR:N - Highest-severity scenario is supplying a malicious filesystem image (USB/SD/cloud disk) that a privileged victim mounts; the attacker needs no privileges of their own. ext4 lacks FS_USERNS_MOUNT, so this is not a self-mount-by-unprivileged-userns case.\nUI:R - Exploitation requires a user or automount path to mount the malicious ext4 filesystem image, which is the interaction that reaches journal recovery and the vulnerable scan loop.\nS:U - Impact is confined to the host kernel authority that performs the mount; there is no VM/IOMMU/sandbox boundary crossing.\nC:H - This is an out-of-bounds read of journal buffer memory; attacker-controlled fc_len (u16) can cause checksum/tag parsing to read far beyond the block (not a few-byte bound), which per guidance scores Confidentiality High.\nI:N - The bug is a pure out-of-bounds read with no write primitive, heap corruption, or control-flow hijack; scanned OOB data only feeds local CRC/region logic and does not modify attacker-controlled kernel state for integrity compromise.\nA:H - Reading past the journal block into unmapped or invalid kernel memory can oops/panic the kernel during mount, fully denying availability."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ext4/fast_commit.c"],"versions":[{"version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","lessThan":"6969367c1500c15eddc38fda12f6d15518ad6d03","status":"affected","versionType":"git"},{"version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","lessThan":"f234294812c9b68d603650d28743eafb718e7ad5","status":"affected","versionType":"git"},{"version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","lessThan":"1b45cc5c7b920fd8bf72e5a888ec7abeadf41e09","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ext4/fast_commit.c"],"versions":[{"version":"5.10","status":"affected"},{"version":"0","lessThan":"5.10","status":"unaffected","versionType":"semver"},{"version":"5.15.87","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.0.6","lessThanOrEqual":"6.0.*","status":"unaffected","versionType":"semver"},{"version":"6.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"5.15.87"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.0.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/6969367c1500c15eddc38fda12f6d15518ad6d03"},{"url":"https://git.kernel.org/stable/c/f234294812c9b68d603650d28743eafb718e7ad5"},{"url":"https://git.kernel.org/stable/c/1b45cc5c7b920fd8bf72e5a888ec7abeadf41e09"}],"title":"ext4: fix potential out of bound read in ext4_fc_replay_scan()","x_generator":{"engine":"bippy-1.2.0"}}}}