LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49348: ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state

In the Linux kernel, the following vulnerability has been resolved: ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state The EXT4_FC_REPLAY bit in sbi->s_mount_state is used to indicate that we are in the middle of replay the fast commit journal. This was actually a mistake, since the sbi->s_mount_info is initialized from es->s_state. Arguably s_mount_state is misleadingly named, but the name is historical --- s_mount_state and s_state dates back to ext2. What should have been used is the ext4_{set,clear,test}_mount_flag() inline functions, which sets EXT4_MF_* bits in sbi->s_mount_flags. The problem with using EXT4_FC_REPLAY is that a maliciously corrupted superblock could result in EXT4_FC_REPLAY getting set in s_mount_state. This bypasses some sanity checks, and this can trigger a BUG() in ext4_es_cache_extent(). As a easy-to-backport-fix, filter out the EXT4_FC_REPLAY bit for now. We should eventually transition away from EXT4_FC_REPLAY to something like EXT4_MF_REPLAY.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-49348 is a Linux ext4 filesystem flaw where a deliberately corrupted superblock can make the kernel skip checks and hit a BUG condition. The public record supports a denial-of-service concern, not code execution. Business risk is highest for systems that mount untrusted ext4 disks, images, or removable media.

Executive priority

Treat this as a kernel availability issue. Prioritize patching internet-adjacent, multi-tenant, forensic, build, or desktop environments that may mount untrusted ext4 content. Routine server fleets with controlled storage still need normal kernel maintenance.

Technical view

ext4 stored the EXT4_FC_REPLAY state in s_mount_state, initialized from the on-disk superblock s_state. A maliciously corrupted superblock could set this replay bit, bypass sanity checks, and trigger BUG() in ext4_es_cache_extent(). The upstream fix filters EXT4_FC_REPLAY from the on-disk state path.

Likely exposure

Linux systems using affected kernel versions and mounting ext4 filesystems are the relevant exposure. Risk is more practical where users, automation, or services mount untrusted filesystem images, external media, or attacker-influenced storage.

Exploitation context

The bundle reports no CISA KEV listing and provides no cited evidence of active exploitation. The described trigger is a maliciously corrupted ext4 superblock causing kernel failure during filesystem handling.

Researcher notes

Evidence is limited to the CVE text and kernel stable references. No CVSS, CWE, distribution advisory, or exploit report is included. Analysis should avoid assuming privilege escalation or remote exploitation without additional vendor evidence.

Mitigation direction

  • Apply Linux vendor kernel updates containing the referenced stable ext4 fixes.
  • Avoid mounting untrusted ext4 images or removable media on sensitive systems.
  • Use isolation for workflows that must inspect third-party filesystem images.
  • Monitor vendor advisories for distribution-specific fixed kernel package versions.

Validation and detection

  • Inventory Linux kernels and compare against vendor fixed packages.
  • Identify systems or services that mount ext4 media, images, or tenant-controlled storage.
  • Confirm updated kernels include the EXT4_FC_REPLAY filtering fix.
  • Review incident records for kernel BUG events involving ext4_es_cache_extent().
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49348 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2, 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2, 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2, 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2, 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2unaffected
LinuxLinux5.10, 0, 5.10.121, 5.15.46, 5.17.14, 5.18.3, 5.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.