LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49425: f2fs: fix dereference of stale list iterator after loop body

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix dereference of stale list iterator after loop body The list iterator variable will be a bogus pointer if no break was hit. Dereferencing it (cur->page in this case) could load an out-of-bounds/undefined value making it unsafe to use that in the comparision to determine if the specific element was found. Since 'cur->page' *can* be out-ouf-bounds it cannot be guaranteed that by chance (or intention of an attacker) it matches the value of 'page' even though the correct element was not found. This is fixed by using a separate list iterator variable for the loop and only setting the original variable if a suitable element was found. Then determing if the element was found is simply checking if the variable is set.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2022-49425 is a Linux kernel f2fs filesystem bug where kernel code could use an invalid list pointer after a search fails. The public record does not provide CVSS, impact rating, or exploitation evidence. Treat it as a kernel memory-safety issue requiring normal kernel update review, especially where f2fs is enabled or used.

Executive priority

Schedule remediation through normal kernel patch cycles, raising priority for systems using f2fs or handling untrusted removable/storage media. There is no public evidence here of exploitation, but kernel memory-safety issues deserve timely maintenance.

Technical view

The flaw is in Linux kernel f2fs code: a list iterator may be stale if a loop exits without finding an element. Dereferencing cur->page can read an out-of-bounds or undefined value and cause incorrect comparison logic. Kernel stable commits change the code to use a separate iterator and only set the result when found.

Likely exposure

Exposure is most likely on Linux systems running affected kernel code with f2fs support enabled or f2fs filesystems in use. The source bundle lists Linux kernel version boundaries, but distro backport status must be checked with the OS vendor.

Exploitation context

No active exploitation is indicated by the provided sources, and the CVE is not marked as KEV. The sources do not specify attack vector, required privileges, or practical impact beyond unsafe dereference and undefined/out-of-bounds value use in kernel f2fs logic.

Researcher notes

The public record lacks CVSS, CWE, and detailed impact analysis. The exact affected-version interpretation may vary by stable branch and distribution backports. Analysis should focus on whether the f2fs fix commits or equivalent patches are present in deployed kernels.

Mitigation direction

  • Review vendor kernel advisories for CVE-2022-49425 applicability.
  • Update affected Linux kernels to vendor-supported fixed builds.
  • Prioritize systems using or allowing f2fs filesystems.
  • If updates are unavailable, follow vendor guidance for risk reduction.

Validation and detection

  • Inventory Linux kernel versions across affected assets.
  • Determine whether f2fs is enabled, loaded, or used.
  • Check vendor advisories for backported fixes.
  • Confirm the relevant stable fix is included in the running kernel.
  • Document exceptions where kernel status cannot be confirmed.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49425 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux8c242db9b8c01b252290e23827163787f07e01d1, 8c242db9b8c01b252290e23827163787f07e01d1, 8c242db9b8c01b252290e23827163787f07e01d1, 8c242db9b8c01b252290e23827163787f07e01d1, 8c242db9b8c01b252290e23827163787f07e01d1, 8c242db9b8c01b252290e23827163787f07e01d1, 8c242db9b8c01b252290e23827163787f07e01d1unaffected
LinuxLinux4.12, 0, 4.19.247, 5.4.198, 5.10.121, 5.15.46, 5.17.14, 5.18.3, 5.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.