LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49364: f2fs: fix to clear dirty inode in f2fs_evict_inode()

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to clear dirty inode in f2fs_evict_inode() As Yanming reported in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=215904 The kernel message is shown below: kernel BUG at fs/f2fs/inode.c:825! Call Trace: evict+0x282/0x4e0 __dentry_kill+0x2b2/0x4d0 shrink_dentry_list+0x17c/0x4f0 shrink_dcache_parent+0x143/0x1e0 do_one_tree+0x9/0x30 shrink_dcache_for_umount+0x51/0x120 generic_shutdown_super+0x5c/0x3a0 kill_block_super+0x90/0xd0 kill_f2fs_super+0x225/0x310 deactivate_locked_super+0x78/0xc0 cleanup_mnt+0x2b7/0x480 task_work_run+0xc8/0x150 exit_to_user_mode_prepare+0x14a/0x150 syscall_exit_to_user_mode+0x1d/0x40 do_syscall_64+0x48/0x90 The root cause is: inode node and dnode node share the same nid, so during f2fs_evict_inode(), dnode node truncation will invalidate its NAT entry, so when truncating inode node, it fails due to invalid NAT entry, result in inode is still marked as dirty, fix this issue by clearing dirty for inode and setting SBI_NEED_FSCK flag in filesystem. output from dump.f2fs: [print_node_info: 354] Node ID [0xf:15] is inode i_nid[0] [0x f : 15]

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects F2FS, a filesystem commonly used on flash storage. A specific inode eviction error can leave an inode dirty, trigger a kernel BUG during unmount or cleanup, and mark the filesystem as needing fsck. Business impact is primarily service disruption or storage maintenance, but severity is not scored in the provided sources.

Executive priority

Treat as a targeted Linux storage reliability issue, not a confirmed internet-facing emergency. Prioritize remediation for devices using F2FS in production, embedded, mobile, or flash-heavy environments where crashes or forced maintenance would disrupt operations.

Technical view

In f2fs_evict_inode(), inode and dnode nodes can share the same nid. Dnode truncation may invalidate the NAT entry before inode truncation, leaving the inode dirty and causing a kernel BUG. The fix clears the dirty inode state and sets SBI_NEED_FSCK so the filesystem is checked.

Likely exposure

Exposure is likely limited to Linux systems using F2FS on affected kernel builds before the referenced stable fixes or downstream backports. Systems not mounting F2FS are unlikely to be exposed based on the provided evidence.

Exploitation context

The source bundle does not show active exploitation, KEV listing, exploit availability, required privileges, or remote reachability. Evidence shows a kernel BUG reported through kernel bugzilla and resolved in Linux stable commits.

Researcher notes

The record lacks CVSS, CWE, privilege requirements, and exploitability details. Analysis should focus on F2FS code lineage, stable kernel backports, and runtime evidence of F2FS use. Avoid assuming impact beyond kernel BUG, dirty inode handling, and filesystem fsck requirement.

Mitigation direction

  • Identify systems that mount or support F2FS filesystems.
  • Update to a kernel containing the referenced stable fixes or vendor backports.
  • Follow Linux distribution guidance for supported patched kernel packages.
  • Schedule filesystem checks where SBI_NEED_FSCK or F2FS errors are observed.

Validation and detection

  • Inventory running kernel versions and distribution backport status.
  • Check whether F2FS filesystems are mounted or used on devices.
  • Review kernel logs for F2FS BUG, eviction, NAT, or fsck-needed messages.
  • Confirm the relevant stable commit is present in the deployed kernel source or package changelog.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49364 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux98e4da8ca301e062d79ae168c67e56f3c3de3ce4, 98e4da8ca301e062d79ae168c67e56f3c3de3ce4, 98e4da8ca301e062d79ae168c67e56f3c3de3ce4, 98e4da8ca301e062d79ae168c67e56f3c3de3ce4, 98e4da8ca301e062d79ae168c67e56f3c3de3ce4, 98e4da8ca301e062d79ae168c67e56f3c3de3ce4unaffected
LinuxLinux3.8, 0, 5.4.198, 5.10.121, 5.15.46, 5.17.14, 5.18.3, 5.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.