LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50638: ext4: fix bug_on in __es_tree_search caused by bad boot loader inode

In the Linux kernel, the following vulnerability has been resolved: ext4: fix bug_on in __es_tree_search caused by bad boot loader inode We got a issue as fllows: ================================================================== kernel BUG at fs/ext4/extents_status.c:203! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 1 PID: 945 Comm: cat Not tainted 6.0.0-next-20221007-dirty #349 RIP: 0010:ext4_es_end.isra.0+0x34/0x42 RSP: 0018:ffffc9000143b768 EFLAGS: 00010203 RAX: 0000000000000000 RBX: ffff8881769cd0b8 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8fc27cf7 RDI: 00000000ffffffff RBP: ffff8881769cd0bc R08: 0000000000000000 R09: ffffc9000143b5f8 R10: 0000000000000001 R11: 0000000000000001 R12: ffff8881769cd0a0 R13: ffff8881768e5668 R14: 00000000768e52f0 R15: 0000000000000000 FS: 00007f359f7f05c0(0000)GS:ffff88842fd00000(0000)knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f359f5a2000 CR3: 000000017130c000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __es_tree_search.isra.0+0x6d/0xf5 ext4_es_cache_extent+0xfa/0x230 ext4_cache_extents+0xd2/0x110 ext4_find_extent+0x5d5/0x8c0 ext4_ext_map_blocks+0x9c/0x1d30 ext4_map_blocks+0x431/0xa50 ext4_mpage_readpages+0x48e/0xe40 ext4_readahead+0x47/0x50 read_pages+0x82/0x530 page_cache_ra_unbounded+0x199/0x2a0 do_page_cache_ra+0x47/0x70 page_cache_ra_order+0x242/0x400 ondemand_readahead+0x1e8/0x4b0 page_cache_sync_ra+0xf4/0x110 filemap_get_pages+0x131/0xb20 filemap_read+0xda/0x4b0 generic_file_read_iter+0x13a/0x250 ext4_file_read_iter+0x59/0x1d0 vfs_read+0x28f/0x460 ksys_read+0x73/0x160 __x64_sys_read+0x1e/0x30 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> ================================================================== In the above issue, ioctl invokes the swap_inode_boot_loader function to swap inode<5> and inode<12>. However, inode<5> contain incorrect imode and disordered extents, and i_nlink is set to 1. The extents check for inode in the ext4_iget function can be bypassed bacause 5 is EXT4_BOOT_LOADER_INO. While links_count is set to 1, the extents are not initialized in swap_inode_boot_loader. After the ioctl command is executed successfully, the extents are swapped to inode<12>, in this case, run the `cat` command to view inode<12>. And Bug_ON is triggered due to the incorrect extents. When the boot loader inode is not initialized, its imode can be one of the following: 1) the imode is a bad type, which is marked as bad_inode in ext4_iget and set to S_IFREG. 2) the imode is good type but not S_IFREG. 3) the imode is S_IFREG. The BUG_ON may be triggered by bypassing the check in cases 1 and 2. Therefore, when the boot loader inode is bad_inode or its imode is not S_IFREG, initialize the inode to avoid triggering the BUG.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-50638 is a Linux kernel ext4 filesystem bug that can trigger a kernel BUG and crash-like failure when a malformed boot loader inode is swapped and then accessed. The published record does not provide CVSS, confirmed exploitation, or detailed privilege requirements.

Executive priority

Treat as a routine-to-priority kernel stability fix. Escalate where shared systems allow untrusted local users or where a kernel crash would materially affect availability.

Technical view

The flaw is in ext4 extent status handling. A bad or non-regular EXT4_BOOT_LOADER_INO can bypass checks, then swap_inode_boot_loader can move invalid extents to another inode. Later file access can hit BUG_ON in __es_tree_search/ext4_es_end. Kernel stable commits initialize unsuitable boot loader inodes to avoid the BUG.

Likely exposure

Linux systems using ext4 may be exposed if running affected kernel builds. The CVE record lists Linux kernel versions including 3.10 through 6.2-era entries, but package-level exposure depends on distribution backports and vendor kernels.

Exploitation context

The source describes a local filesystem/ioctl-driven trigger followed by file access. It supports denial-of-service style impact through a kernel BUG. There is no KEV listing and no cited evidence of active exploitation in the provided sources.

Researcher notes

Evidence is limited to the CVE record and kernel stable commits. The record lacks CVSS, CWE, exploit status, and clear privilege requirements. Avoid assuming remote exposure or confirmed exploitation. Main observable impact is kernel BUG from malformed ext4 boot loader inode handling.

Mitigation direction

  • Update to a kernel that includes the referenced ext4 stable fixes.
  • Check Linux distribution advisories for backported packages and affected kernel builds.
  • Prioritize systems with untrusted local users or workloads handling ext4 filesystems.
  • If patch status is unclear, follow vendor kernel guidance.

Validation and detection

  • Inventory Linux hosts and kernel versions using ext4 filesystems.
  • Confirm whether installed kernels contain the referenced stable commits or vendor backports.
  • Review vendor advisories for CVE-2022-50638 applicability.
  • Monitor kernel logs for ext4 BUG messages matching the described call path.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50638 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
10Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux393d1d1d76933886d5e1ce603214c9987589c6d5, 393d1d1d76933886d5e1ce603214c9987589c6d5, 393d1d1d76933886d5e1ce603214c9987589c6d5, 393d1d1d76933886d5e1ce603214c9987589c6d5, 393d1d1d76933886d5e1ce603214c9987589c6d5, 393d1d1d76933886d5e1ce603214c9987589c6d5, 393d1d1d76933886d5e1ce603214c9987589c6d5, 393d1d1d76933886d5e1ce603214c9987589c6d5, 393d1d1d76933886d5e1ce603214c9987589c6d5unaffected
LinuxLinux3.10, 0, 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.87, 6.0.18, 6.1.4, 6.2affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.