LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49352: ext4: fix warning in ext4_handle_inode_extension

In the Linux kernel, the following vulnerability has been resolved: ext4: fix warning in ext4_handle_inode_extension We got issue as follows: EXT4-fs error (device loop0) in ext4_reserve_inode_write:5741: Out of memory EXT4-fs error (device loop0): ext4_setattr:5462: inode #13: comm syz-executor.0: mark_inode_dirty error EXT4-fs error (device loop0) in ext4_setattr:5519: Out of memory EXT4-fs error (device loop0): ext4_ind_map_blocks:595: inode #13: comm syz-executor.0: Can't allocate blocks for non-extent mapped inodes with bigalloc ------------[ cut here ]------------ WARNING: CPU: 1 PID: 4361 at fs/ext4/file.c:301 ext4_file_write_iter+0x11c9/0x1220 Modules linked in: CPU: 1 PID: 4361 Comm: syz-executor.0 Not tainted 5.10.0+ #1 RIP: 0010:ext4_file_write_iter+0x11c9/0x1220 RSP: 0018:ffff924d80b27c00 EFLAGS: 00010282 RAX: ffffffff815a3379 RBX: 0000000000000000 RCX: 000000003b000000 RDX: ffff924d81601000 RSI: 00000000000009cc RDI: 00000000000009cd RBP: 000000000000000d R08: ffffffffbc5a2c6b R09: 0000902e0e52a96f R10: ffff902e2b7c1b40 R11: ffff902e2b7c1b40 R12: 000000000000000a R13: 0000000000000001 R14: ffff902e0e52aa10 R15: ffffffffffffff8b FS: 00007f81a7f65700(0000) GS:ffff902e3bc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffff600400 CR3: 000000012db88001 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: do_iter_readv_writev+0x2e5/0x360 do_iter_write+0x112/0x4c0 do_pwritev+0x1e5/0x390 __x64_sys_pwritev2+0x7e/0xa0 do_syscall_64+0x37/0x50 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Above issue may happen as follows: Assume inode.i_size=4096 EXT4_I(inode)->i_disksize=4096 step 1: set inode->i_isize = 8192 ext4_setattr if (attr->ia_size != inode->i_size) EXT4_I(inode)->i_disksize = attr->ia_size; rc = ext4_mark_inode_dirty ext4_reserve_inode_write ext4_get_inode_loc __ext4_get_inode_loc sb_getblk --> return -ENOMEM ... if (!error) ->will not update i_size i_size_write(inode, attr->ia_size); Now: inode.i_size=4096 EXT4_I(inode)->i_disksize=8192 step 2: Direct write 4096 bytes ext4_file_write_iter ext4_dio_write_iter iomap_dio_rw ->return error if (extend) ext4_handle_inode_extension WARN_ON_ONCE(i_size_read(inode) < EXT4_I(inode)->i_disksize); ->Then trigger warning. To solve above issue, if mark inode dirty failed in ext4_setattr just set 'EXT4_I(inode)->i_disksize' with old value.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2022-49352 is a Linux kernel ext4 filesystem bug where a failed inode metadata update can leave file size state inconsistent and later trigger a kernel warning. The source does not provide CVSS, CWE, or a demonstrated security impact, so business urgency depends on kernel exposure and vendor backports.

Executive priority

Treat this as a routine kernel maintenance item unless your environment exposes ext4 operations to untrusted local users or tenants. There is no provided evidence of active exploitation or severe impact, but affected kernels should still receive vendor-backed updates.

Technical view

The issue occurs in ext4_setattr when ext4_mark_inode_dirty fails, such as from ENOMEM, after EXT4_I(inode)->i_disksize was changed but before inode->i_size is updated. A later direct write path can reach ext4_handle_inode_extension and trigger WARN_ON_ONCE because i_size is lower than i_disksize. The fix restores the old i_disksize on failure.

Likely exposure

Exposure is most relevant to Linux systems running affected kernel versions with ext4 filesystems. The bundle lists Linux as affected and references stable kernel fixes. It does not identify distributions, appliances, cloud images, or container runtimes that inherited the bug.

Exploitation context

The source describes a syzkaller-style local filesystem sequence involving setattr, memory allocation failure, and direct write behavior. It does not state remote exploitability, privilege escalation, data disclosure, or active exploitation. KEV is false in the provided bundle.

Researcher notes

Evidence is limited to the Linux kernel fix narrative and stable commit references. The core validation point is whether ext4_setattr restores EXT4_I(inode)->i_disksize when ext4_mark_inode_dirty fails. Do not infer broader impact without distribution advisories or additional kernel analysis.

Mitigation direction

  • Upgrade to a kernel containing the referenced upstream stable ext4 fix.
  • Check Linux distribution advisories for backported fixes for your exact kernel package.
  • Prioritize systems using ext4 with untrusted local workloads or filesystem fuzzing exposure.
  • Monitor kernel logs for related ext4 WARN_ON or ENOMEM error patterns.

Validation and detection

  • Inventory Linux kernel versions and identify systems using ext4 filesystems.
  • Map installed kernels against vendor advisories and the referenced stable commits.
  • Review kernel logs for ext4_setattr, ext4_file_write_iter, or i_disksize warnings.
  • Confirm patched systems include the ext4_setattr rollback behavior on inode dirty failure.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49352 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxb1b4705d54abedfd69dcdf42779c521aa1e0fbd3, b1b4705d54abedfd69dcdf42779c521aa1e0fbd3, b1b4705d54abedfd69dcdf42779c521aa1e0fbd3, b1b4705d54abedfd69dcdf42779c521aa1e0fbd3, b1b4705d54abedfd69dcdf42779c521aa1e0fbd3unaffected
LinuxLinux5.5, 0, 5.10.121, 5.15.46, 5.17.14, 5.18.3, 5.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.