LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50620: f2fs: fix to invalidate dcc->f2fs_issue_discard in error path

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to invalidate dcc->f2fs_issue_discard in error path Syzbot reports a NULL pointer dereference issue as below: __refcount_add include/linux/refcount.h:193 [inline] __refcount_inc include/linux/refcount.h:250 [inline] refcount_inc include/linux/refcount.h:267 [inline] get_task_struct include/linux/sched/task.h:110 [inline] kthread_stop+0x34/0x1c0 kernel/kthread.c:703 f2fs_stop_discard_thread+0x3c/0x5c fs/f2fs/segment.c:1638 kill_f2fs_super+0x5c/0x194 fs/f2fs/super.c:4522 deactivate_locked_super+0x70/0xe8 fs/super.c:332 deactivate_super+0xd0/0xd4 fs/super.c:363 cleanup_mnt+0x1f8/0x234 fs/namespace.c:1186 __cleanup_mnt+0x20/0x30 fs/namespace.c:1193 task_work_run+0xc4/0x14c kernel/task_work.c:177 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0x26c/0xbe0 kernel/exit.c:795 do_group_exit+0x60/0xe8 kernel/exit.c:925 __do_sys_exit_group kernel/exit.c:936 [inline] __se_sys_exit_group kernel/exit.c:934 [inline] __wake_up_parent+0x0/0x40 kernel/exit.c:934 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall arch/arm64/kernel/syscall.c:52 [inline] el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:636 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581 The root cause of this issue is in error path of f2fs_start_discard_thread(), it missed to invalidate dcc->f2fs_issue_discard, later kthread_stop() may access invalid pointer.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel flaw in F2FS, a flash-friendly filesystem. A failed discard-thread startup can leave an invalid pointer that is later used during cleanup, causing a NULL pointer dereference. Business impact is most likely system instability or denial of service on affected Linux systems using F2FS.

Executive priority

Treat as a targeted kernel stability issue, not an internet-facing emergency. Prioritize patching where F2FS is used, especially on production Linux systems where unplanned crashes would disrupt service.

Technical view

CVE-2022-50620 is in fs/f2fs. In the error path of f2fs_start_discard_thread(), dcc->f2fs_issue_discard was not invalidated. Later, f2fs_stop_discard_thread() may call kthread_stop() on an invalid task pointer, triggering a kernel NULL pointer dereference. Kernel stable commits are listed as references.

Likely exposure

Exposure is most relevant to Linux systems running affected kernel versions with F2FS in use. The source lists Linux kernel versions including 5.15, 5.15.86, 6.0.16, 6.1.2, and 6.2 as affected entries, but distribution backport status must be verified separately.

Exploitation context

The source ties discovery to a syzbot report and kernel error path behavior. No public source in the bundle states active exploitation, and CISA KEV is false. Practical impact appears to require reaching the F2FS discard-thread startup failure and cleanup path.

Researcher notes

Severity, CVSS, and CWE are not provided in the source bundle. The affected-version data is limited and somewhat coarse, so validation should rely on kernel commit presence and distribution backport notes rather than version strings alone.

Mitigation direction

  • Apply Linux kernel updates that include the referenced stable fixes.
  • Check your Linux distribution advisory for backported fixes.
  • Prioritize systems using F2FS filesystems.
  • If no vendor package exists, follow kernel maintainer guidance.

Validation and detection

  • Inventory Linux kernel versions across affected assets.
  • Identify hosts using F2FS filesystems.
  • Verify installed kernels include the referenced stable commits or vendor backports.
  • Review kernel logs for F2FS NULL pointer dereference symptoms.
  • Track distro advisories for CVE-2022-50620 status.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50620 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux4d67490498acb4ffcef5ba7bc44990d46e66a44c, 4d67490498acb4ffcef5ba7bc44990d46e66a44c, 4d67490498acb4ffcef5ba7bc44990d46e66a44c, 4d67490498acb4ffcef5ba7bc44990d46e66a44cunaffected
LinuxLinux5.15, 0, 5.15.86, 6.0.16, 6.1.2, 6.2affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.