LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49361: f2fs: fix to do sanity check for inline inode

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check for inline inode Yanming reported a kernel bug in Bugzilla kernel [1], which can be reproduced. The bug message is: The kernel message is shown below: kernel BUG at fs/inode.c:611! Call Trace: evict+0x282/0x4e0 __dentry_kill+0x2b2/0x4d0 dput+0x2dd/0x720 do_renameat2+0x596/0x970 __x64_sys_rename+0x78/0x90 do_syscall_64+0x3b/0x90 [1] https://bugzilla.kernel.org/show_bug.cgi?id=215895 The bug is due to fuzzed inode has both inline_data and encrypted flags. During f2fs_evict_inode(), as the inode was deleted by rename(), it will cause inline data conversion due to conflicting flags. The page cache will be polluted and the panic will be triggered in clear_inode(). Try fixing the bug by doing more sanity checks for inline data inode in sanity_check_inode().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-49361 is a Linux kernel F2FS bug that can trigger a kernel panic when a malformed inode combines conflicting inline data and encryption flags. The business impact is availability: affected systems using F2FS could crash. The sources do not provide CVSS scoring or evidence of active exploitation.

Executive priority

Treat as a targeted availability risk rather than a confirmed widespread emergency. Patch through normal kernel maintenance, with higher urgency for systems that process untrusted F2FS filesystems or where crashes would disrupt operations.

Technical view

The flaw is in F2FS inode sanity handling. A fuzzed inode with both inline_data and encrypted flags can reach f2fs_evict_inode() during rename deletion, trigger inline data conversion, pollute page cache state, and panic in clear_inode(). Stable kernel commits add sanity checks for inline data inodes.

Likely exposure

Exposure is limited to Linux systems running affected kernel versions and using or mounting F2FS filesystems. Systems that do not enable or mount F2FS are less likely to be exposed. Version applicability should be confirmed against the running kernel vendor’s backport status.

Exploitation context

The public source describes reproduction through a fuzzed inode and a kernel Bugzilla report. It does not cite remote attackability, privilege requirements, CVSS, or active exploitation. CISA KEV status is false in the provided bundle.

Researcher notes

Evidence supports a denial-of-service kernel panic path, not code execution. The CVE data is sparse: no CVSS, CWE, exploit maturity, or vendor distribution mapping is provided. Validate impact through kernel source lineage and downstream backports.

Mitigation direction

  • Update to a vendor kernel containing the referenced F2FS sanity-check fixes.
  • Prioritize systems that mount untrusted or removable F2FS media.
  • Confirm distribution advisories for exact backported fixed versions.
  • Limit F2FS mounting where it is unnecessary until patched.

Validation and detection

  • Inventory Linux hosts and identify those with F2FS support or mounted F2FS filesystems.
  • Compare running kernel builds against vendor advisories and referenced stable commits.
  • Review crash logs for F2FS, clear_inode, evict, or rename-related kernel panics.
  • Verify patched kernels include the inline inode sanity-check change.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49361 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux98e4da8ca301e062d79ae168c67e56f3c3de3ce4, 98e4da8ca301e062d79ae168c67e56f3c3de3ce4, 98e4da8ca301e062d79ae168c67e56f3c3de3ce4, 98e4da8ca301e062d79ae168c67e56f3c3de3ce4, 98e4da8ca301e062d79ae168c67e56f3c3de3ce4unaffected
LinuxLinux3.8, 0, 5.10.121, 5.15.46, 5.17.14, 5.18.3, 5.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.