LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49739: gfs2: Always check inode size of inline inodes

In the Linux kernel, the following vulnerability has been resolved: gfs2: Always check inode size of inline inodes Check if the inode size of stuffed (inline) inodes is within the allowed range when reading inodes from disk (gfs2_dinode_in()). This prevents us from on-disk corruption. The two checks in stuffed_readpage() and gfs2_unstuffer_page() that just truncate inline data to the maximum allowed size don't actually make sense, and they can be removed now as well.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects GFS2, a clustered filesystem. The kernel did not consistently validate the size of inline inode data read from disk. The cited record does not provide a CVSS score, impact rating, or active exploitation evidence, so urgency depends on whether an environment uses GFS2.

Executive priority

Treat as targeted infrastructure hygiene unless GFS2 is used in production storage. For GFS2 clusters, schedule kernel patching through normal change control. For environments without GFS2, document non-exposure after validation.

Technical view

GFS2 should reject stuffed inline inodes whose on-disk inode size exceeds the allowed range during gfs2_dinode_in(). The fix adds that validation and removes later truncation behavior in stuffed_readpage() and gfs2_unstuffer_page(). Source material does not define a concrete security outcome beyond preventing unsafe handling of corrupt on-disk metadata.

Likely exposure

Exposure is most plausible on Linux systems that mount or process GFS2 filesystems, especially clustered storage environments. The provided data lists Linux kernel versions and stable commits, but does not provide distribution package mappings or CPEs.

Exploitation context

The source bundle shows no CISA KEV listing and provides no cited evidence of active exploitation. It also does not describe a remote attack path, required privileges, or whether crafted filesystem access is required.

Researcher notes

Evidence is limited to the CVE record and Linux stable commit references. No CVSS, CWE, CPE, exploit status, or detailed impact analysis is provided. Avoid assuming memory corruption, denial of service, or privilege escalation without additional vendor evidence.

Mitigation direction

  • Apply vendor kernel updates containing the referenced GFS2 stable fixes.
  • Prioritize hosts that mount or process GFS2 filesystems.
  • Check distribution advisories for backported fixed kernel packages.
  • Avoid mounting untrusted GFS2 filesystem images until patched.

Validation and detection

  • Inventory Linux hosts where GFS2 is enabled or mounted.
  • Compare kernel packages against vendor fixed versions or referenced commits.
  • Review vulnerability scanner findings for CVE-2022-49739 on storage nodes.
  • Confirm patched kernels are running after maintenance windows.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49739 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxb3b94faa5fe5968827ba0640ee9fba4b3e7f736e, b3b94faa5fe5968827ba0640ee9fba4b3e7f736e, b3b94faa5fe5968827ba0640ee9fba4b3e7f736e, b3b94faa5fe5968827ba0640ee9fba4b3e7f736e, b3b94faa5fe5968827ba0640ee9fba4b3e7f736e, b3b94faa5fe5968827ba0640ee9fba4b3e7f736eunaffected
LinuxLinux2.6.19, 0, 4.19.280, 5.4.240, 5.10.177, 5.15.93, 6.1.11, 6.2affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.