LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50270: f2fs: fix the assign logic of iocb

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix the assign logic of iocb commit 18ae8d12991b ("f2fs: show more DIO information in tracepoint") introduces iocb field in 'f2fs_direct_IO_enter' trace event And it only assigns the pointer and later it accesses its field in trace print log. Unable to handle kernel paging request at virtual address ffffffc04cef3d30 Mem abort info: ESR = 0x96000007 EC = 0x25: DABT (current EL), IL = 32 bits pc : trace_raw_output_f2fs_direct_IO_enter+0x54/0xa4 lr : trace_raw_output_f2fs_direct_IO_enter+0x2c/0xa4 sp : ffffffc0443cbbd0 x29: ffffffc0443cbbf0 x28: ffffff8935b120d0 x27: ffffff8935b12108 x26: ffffff8935b120f0 x25: ffffff8935b12100 x24: ffffff8935b110c0 x23: ffffff8935b10000 x22: ffffff88859a936c x21: ffffff88859a936c x20: ffffff8935b110c0 x19: ffffff8935b10000 x18: ffffffc03b195060 x17: ffffff8935b11e76 x16: 00000000000000cc x15: ffffffef855c4f2c x14: 0000000000000001 x13: 000000000000004e x12: ffff0000ffffff00 x11: ffffffef86c350d0 x10: 00000000000010c0 x9 : 000000000fe0002c x8 : ffffffc04cef3d28 x7 : 7f7f7f7f7f7f7f7f x6 : 0000000002000000 x5 : ffffff8935b11e9a x4 : 0000000000006250 x3 : ffff0a00ffffff04 x2 : 0000000000000002 x1 : ffffffef86a0a31f x0 : ffffff8935b10000 Call trace: trace_raw_output_f2fs_direct_IO_enter+0x54/0xa4 print_trace_fmt+0x9c/0x138 print_trace_line+0x154/0x254 tracing_read_pipe+0x21c/0x380 vfs_read+0x108/0x3ac ksys_read+0x7c/0xec __arm64_sys_read+0x20/0x30 invoke_syscall+0x60/0x150 el0_svc_common.llvm.1237943816091755067+0xb8/0xf8 do_el0_svc+0x28/0xa0 Fix it by copying the required variables for printing and while at it fix the similar issue at some other places in the same file.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-50270 is a Linux kernel F2FS tracing bug. Under the documented condition, the kernel can access invalid memory while printing direct I/O trace output, causing a kernel paging fault. The sources show a fix in stable kernel commits, but provide no CVSS score or evidence of active exploitation.

Executive priority

Schedule normal-to-prioritized kernel patching, especially for systems using F2FS. There is credible crash evidence, but no provided evidence of active exploitation or remote attack paths.

Technical view

The F2FS f2fs_direct_IO_enter trace event stored an iocb pointer, then later dereferenced fields while formatting trace output. The fix copies required values into the trace event instead of relying on the pointer, and addresses similar patterns in the same file.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions or commits with F2FS code paths and trace output for F2FS direct I/O. The source bundle does not establish remote reachability or broad default exploitability.

Exploitation context

The bundle includes a kernel crash trace from trace output handling. It does not cite public exploit code, active exploitation, or CISA KEV listing. Exploitability beyond crash-inducing conditions is not established.

Researcher notes

The key issue is lifetime-safe trace event data capture. Review the upstream stable commits for exact patched branches and similar tracepoint pointer dereferences. The bundle lacks CVSS, CWE, and downstream distribution status.

Mitigation direction

  • Identify Linux kernels in the affected version ranges or commits.
  • Upgrade to a stable kernel containing one of the referenced fixes.
  • Prioritize hosts using F2FS or F2FS tracing workflows.
  • Check distribution vendor advisories for packaged kernel backports.
  • Avoid treating upstream version numbers as definitive for vendor kernels.

Validation and detection

  • Inventory kernel versions and vendor package revisions across Linux assets.
  • Confirm whether F2FS is used on filesystems or test images.
  • Review kernel changelogs for the referenced stable commits.
  • Check monitoring for kernel oops or paging faults in F2FS tracing paths.
  • Validate patched systems no longer carry the vulnerable tracepoint logic.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50270 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxbd984c03097b8e9b7500cba7378040ac1c697dbb, bd984c03097b8e9b7500cba7378040ac1c697dbb, bd984c03097b8e9b7500cba7378040ac1c697dbbunaffected
LinuxLinux5.17, 0, 6.0.16, 6.1.2, 6.2affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.