In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfs_mdt_destroy In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc() fails, which causes inode->i_private uninitialized. Then nilfs_is_metadata_file_inode() returns true and nilfs_free_inode() wrongly calls nilfs_mdt_destroy(), which frees the uninitialized inode->i_private and leads to crashes(e.g., UAF/GPF). Fix this by moving security_inode_alloc just prior to this_cpu_inc(nr_inodes)

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/1e555c3ed1fce4b278aaebe18a64a934cece57d8 cve-icon cve-icon
https://git.kernel.org/stable/c/2a96b532098284ecf8e4849b8b9e5fc7a28bdee9 cve-icon cve-icon
https://git.kernel.org/stable/c/2e488f13755ffbb60f307e991b27024716a33b29 cve-icon cve-icon
https://git.kernel.org/stable/c/64b79e632869ad3ef6c098a4731d559381da1115 cve-icon cve-icon
https://git.kernel.org/stable/c/70e4f70d54e0225f91814e8610477d65f33cefe4 cve-icon cve-icon
https://git.kernel.org/stable/c/81de80330fa6907aec32eb54c5619059e6e36452 cve-icon cve-icon
https://git.kernel.org/stable/c/c0aa76b0f17f59dd9c9d3463550a2986a1d592e4 cve-icon cve-icon
https://git.kernel.org/stable/c/d1ff475d7c83289d0a7faef346ea3bbf90818bad cve-icon cve-icon
https://git.kernel.org/stable/c/ec2aab115eb38ac4992ea2fcc2a02fbe7af5cf48 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025091716-CVE-2022-50367-651c@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-50367 cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-50367 cve-icon
History

Thu, 18 Sep 2025 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Vendors & Products Linux
Linux linux Kernel

Thu, 18 Sep 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Wed, 17 Sep 2025 15:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfs_mdt_destroy In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc() fails, which causes inode->i_private uninitialized. Then nilfs_is_metadata_file_inode() returns true and nilfs_free_inode() wrongly calls nilfs_mdt_destroy(), which frees the uninitialized inode->i_private and leads to crashes(e.g., UAF/GPF). Fix this by moving security_inode_alloc just prior to this_cpu_inc(nr_inodes)
Title fs: fix UAF/GPF bug in nilfs_mdt_destroy
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-09-17T14:56:23.190Z

Updated: 2025-09-17T14:56:23.190Z

Reserved: 2025-09-17T14:53:06.995Z

Link: CVE-2022-50367

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-09-17T15:15:35.590

Modified: 2025-09-18T13:43:34.310

Link: CVE-2022-50367

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-09-17T00:00:00Z

Links: CVE-2022-50367 - Bugzilla