LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49409: ext4: fix bug_on in __es_tree_search

In the Linux kernel, the following vulnerability has been resolved: ext4: fix bug_on in __es_tree_search Hulk Robot reported a BUG_ON: ================================================================== kernel BUG at fs/ext4/extents_status.c:199! [...] RIP: 0010:ext4_es_end fs/ext4/extents_status.c:199 [inline] RIP: 0010:__es_tree_search+0x1e0/0x260 fs/ext4/extents_status.c:217 [...] Call Trace: ext4_es_cache_extent+0x109/0x340 fs/ext4/extents_status.c:766 ext4_cache_extents+0x239/0x2e0 fs/ext4/extents.c:561 ext4_find_extent+0x6b7/0xa20 fs/ext4/extents.c:964 ext4_ext_map_blocks+0x16b/0x4b70 fs/ext4/extents.c:4384 ext4_map_blocks+0xe26/0x19f0 fs/ext4/inode.c:567 ext4_getblk+0x320/0x4c0 fs/ext4/inode.c:980 ext4_bread+0x2d/0x170 fs/ext4/inode.c:1031 ext4_quota_read+0x248/0x320 fs/ext4/super.c:6257 v2_read_header+0x78/0x110 fs/quota/quota_v2.c:63 v2_check_quota_file+0x76/0x230 fs/quota/quota_v2.c:82 vfs_load_quota_inode+0x5d1/0x1530 fs/quota/dquot.c:2368 dquot_enable+0x28a/0x330 fs/quota/dquot.c:2490 ext4_quota_enable fs/ext4/super.c:6137 [inline] ext4_enable_quotas+0x5d7/0x960 fs/ext4/super.c:6163 ext4_fill_super+0xa7c9/0xdc00 fs/ext4/super.c:4754 mount_bdev+0x2e9/0x3b0 fs/super.c:1158 mount_fs+0x4b/0x1e4 fs/super.c:1261 [...] ================================================================== Above issue may happen as follows: ------------------------------------- ext4_fill_super ext4_enable_quotas ext4_quota_enable ext4_iget __ext4_iget ext4_ext_check_inode ext4_ext_check __ext4_ext_check ext4_valid_extent_entries Check for overlapping extents does't take effect dquot_enable vfs_load_quota_inode v2_check_quota_file v2_read_header ext4_quota_read ext4_bread ext4_getblk ext4_map_blocks ext4_ext_map_blocks ext4_find_extent ext4_cache_extents ext4_es_cache_extent ext4_es_cache_extent __es_tree_search ext4_es_end BUG_ON(es->es_lblk + es->es_len < es->es_lblk) The error ext4 extents is as follows: 0af3 0300 0400 0000 00000000 extent_header 00000000 0100 0000 12000000 extent1 00000000 0100 0000 18000000 extent2 02000000 0400 0000 14000000 extent3 In the ext4_valid_extent_entries function, if prev is 0, no error is returned even if lblock<=prev. This was intended to skip the check on the first extent, but in the error image above, prev=0+1-1=0 when checking the second extent, so even though lblock<=prev, the function does not return an error. As a result, bug_ON occurs in __es_tree_search and the system panics. To solve this problem, we only need to check that: 1. The lblock of the first extent is not less than 0. 2. The lblock of the next extent is not less than the next block of the previous extent. The same applies to extent_idx.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-49409 is a Linux kernel ext4 bug that can trigger a kernel BUG_ON and panic when ext4 processes malformed or inconsistent extent metadata. The business impact is availability: affected systems may crash while mounting or reading an ext4 filesystem, especially where untrusted or damaged filesystem images can be introduced.

Executive priority

Prioritize patching where Linux systems mount untrusted or removable ext4 media, host tenant-controlled disk images, or perform forensic and backup processing. For tightly controlled servers, treat as normal kernel hygiene unless availability requirements are strict.

Technical view

The issue is in ext4 extent validation and extent status tree lookup. A check intended to detect overlapping extents can miss a bad second extent when the previous extent calculation leaves prev at zero. Later, __es_tree_search calls ext4_es_end and hits a BUG_ON, causing panic.

Likely exposure

Exposure is most relevant for Linux hosts using ext4 that mount external, user-supplied, virtualized, backup, forensic, or otherwise untrusted filesystem images. Standard servers with controlled disks are less exposed, but corrupted ext4 metadata could still trigger the crash path.

Exploitation context

The provided sources do not show active exploitation, and KEV status is false. The demonstrated impact is kernel panic during ext4 quota and extent processing. Evidence supports denial of service, not data theft or code execution.

Researcher notes

The source describes a validation logic flaw for ext4 extents and extent_idx handling. The affected-version data is incomplete in the bundle, so rely on distribution backports or the listed kernel stable commits rather than raw upstream version assumptions.

Mitigation direction

  • Apply Linux kernel or distribution updates containing the referenced ext4 fix.
  • Check vendor advisories for supported fixed kernel packages.
  • Avoid mounting untrusted ext4 images on production hosts.
  • Process external filesystem images in isolated, disposable analysis environments.
  • Review recovery plans for systems that auto-mount removable or virtual disks.

Validation and detection

  • Inventory Linux systems using ext4 filesystems.
  • Identify kernel versions and distribution patch levels.
  • Confirm whether vendor kernels include the referenced stable commits.
  • Review mount workflows for untrusted disks or filesystem images.
  • Check logs for ext4 BUG_ON, panic, or quota-load failures.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49409 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux5946d089379a35dda0e531710b48fca05446a196, 5946d089379a35dda0e531710b48fca05446a196, 5946d089379a35dda0e531710b48fca05446a196, 5946d089379a35dda0e531710b48fca05446a196, 5946d089379a35dda0e531710b48fca05446a196, 5946d089379a35dda0e531710b48fca05446a196, 4645e4ee32aee01a85bdc03348982a65c65ce216, a1192c0e5d037def6763f3873d3340615c241fe7, ae21dda05193c441bde106a4bbf88c185a68fbed, ea214c946ee77588c4313be3e9951edd25d6b270unaffected
LinuxLinux3.13, 0, 5.4.277, 5.10.121, 5.15.46, 5.17.14, 5.18.3, 5.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.