LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49347: ext4: fix bug_on in ext4_writepages

In the Linux kernel, the following vulnerability has been resolved: ext4: fix bug_on in ext4_writepages we got issue as follows: EXT4-fs error (device loop0): ext4_mb_generate_buddy:1141: group 0, block bitmap and bg descriptor inconsistent: 25 vs 31513 free cls ------------[ cut here ]------------ kernel BUG at fs/ext4/inode.c:2708! invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 2 PID: 2147 Comm: rep Not tainted 5.18.0-rc2-next-20220413+ #155 RIP: 0010:ext4_writepages+0x1977/0x1c10 RSP: 0018:ffff88811d3e7880 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffff88811c098000 RDX: 0000000000000000 RSI: ffff88811c098000 RDI: 0000000000000002 RBP: ffff888128140f50 R08: ffffffffb1ff6387 R09: 0000000000000000 R10: 0000000000000007 R11: ffffed10250281ea R12: 0000000000000001 R13: 00000000000000a4 R14: ffff88811d3e7bb8 R15: ffff888128141028 FS: 00007f443aed9740(0000) GS:ffff8883aef00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020007200 CR3: 000000011c2a4000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> do_writepages+0x130/0x3a0 filemap_fdatawrite_wbc+0x83/0xa0 filemap_flush+0xab/0xe0 ext4_alloc_da_blocks+0x51/0x120 __ext4_ioctl+0x1534/0x3210 __x64_sys_ioctl+0x12c/0x170 do_syscall_64+0x3b/0x90 It may happen as follows: 1. write inline_data inode vfs_write new_sync_write ext4_file_write_iter ext4_buffered_write_iter generic_perform_write ext4_da_write_begin ext4_da_write_inline_data_begin -> If inline data size too small will allocate block to write, then mapping will has dirty page ext4_da_convert_inline_data_to_extent ->clear EXT4_STATE_MAY_INLINE_DATA 2. fallocate do_vfs_ioctl ioctl_preallocate vfs_fallocate ext4_fallocate ext4_convert_inline_data ext4_convert_inline_data_nolock ext4_map_blocks -> fail will goto restore data ext4_restore_inline_data ext4_create_inline_data ext4_write_inline_data ext4_set_inode_state -> set inode EXT4_STATE_MAY_INLINE_DATA 3. writepages __ext4_ioctl ext4_alloc_da_blocks filemap_flush filemap_fdatawrite_wbc do_writepages ext4_writepages if (ext4_has_inline_data(inode)) BUG_ON(ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)) The root cause of this issue is we destory inline data until call ext4_writepages under delay allocation mode. But there maybe already convert from inline to extent. To solve this issue, we call filemap_flush first..

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-49347 is a Linux kernel ext4 filesystem bug that can trigger a kernel BUG during writeback. The available source indicates a crash condition, not data theft or remote compromise. Business urgency depends on whether affected kernels run ext4 filesystems where untrusted users or workloads can write files.

Executive priority

Treat as a patch-management item for Linux availability risk. Prioritize multi-user, hosting, CI, container, and storage-heavy systems before isolated single-purpose appliances. Escalate only if vendor guidance identifies broader impact in your environment.

Technical view

The bug is in ext4_writepages handling of inline data, delayed allocation, fallocate, and writeback state transitions. A stale EXT4_STATE_MAY_INLINE_DATA condition can hit BUG_ON after inline-to-extent conversion and restore paths. Kernel stable references show the issue was resolved by flushing earlier in the affected path.

Likely exposure

Exposure is most likely on Linux systems using affected kernel versions with ext4 filesystems, especially where local users, containers, or services can write to ext4-backed storage. The source lists Linux as affected but provides no CPEs or distribution-specific package mapping.

Exploitation context

The bundle does not show active exploitation, and KEV is false. The described trigger is local filesystem activity involving writes, allocation, and writeback on ext4. No remote attack path, privilege escalation, or public exploit evidence is provided in the supplied sources.

Researcher notes

Evidence supports a local ext4 kernel BUG condition caused by inline data and delayed allocation state handling. The source lacks CVSS, CWE, CPEs, exploit reports, and distro package details. Validate exposure through kernel lineage and vendor backport status rather than version strings alone.

Mitigation direction

  • Update to a Linux kernel build that includes the referenced ext4 fix.
  • Check distribution vendor advisories for the fixed package version.
  • Prioritize shared systems where untrusted users can write to ext4 storage.
  • Reduce untrusted write access to affected ext4-backed systems until patched.

Validation and detection

  • Inventory Linux kernel versions and ext4 filesystem usage across servers and images.
  • Map running kernels against vendor advisories and the CVE affected version data.
  • Confirm deployed kernel source or changelog includes the referenced stable commit.
  • Review crash logs for ext4_writepages BUG or ext4 inline data errors.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49347 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
10Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux3c47d54170b6a678875566b1b8d6dcf57904e49b, 3c47d54170b6a678875566b1b8d6dcf57904e49b, 3c47d54170b6a678875566b1b8d6dcf57904e49b, 3c47d54170b6a678875566b1b8d6dcf57904e49b, 3c47d54170b6a678875566b1b8d6dcf57904e49b, 3c47d54170b6a678875566b1b8d6dcf57904e49b, 3c47d54170b6a678875566b1b8d6dcf57904e49b, 3c47d54170b6a678875566b1b8d6dcf57904e49b, 3c47d54170b6a678875566b1b8d6dcf57904e49bunaffected
LinuxLinux3.8, 0, 4.9.318, 4.14.283, 4.19.247, 5.4.198, 5.10.121, 5.15.46, 5.17.14, 5.18.3, 5.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.