CVE-2022-50126
published 2025-06-18CVE-2022-50126: In the Linux kernel, the following vulnerability has been resolved: jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted Following…
PriorityP419medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.16%
5.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted
Following process will fail assertion 'jh->b_frozen_data == NULL' in
jbd2_journal_dirty_metadata():
jbd2_journal_commit_transaction
unlink(dir/a)
jh->b_transaction = trans1
jh->b_jlist = BJ_Metadata
journal->j_running_transaction = NULL
trans1->t_state = T_COMMIT
unlink(dir/b)
handle->h_trans = trans2
do_get_write_access
jh->b_modified = 0
jh->b_frozen_data = frozen_buffer
jh->b_next_transaction = trans2
jbd2_journal_dirty_metadata
is_handle_aborted
is_journal_aborted // return false
--> jbd2 abort t_buffers)
if (is_journal_aborted)
jbd2_journal_refile_buffer
__jbd2_journal_refile_buffer
WRITE_ONCE(jh->b_transaction,
jh->b_next_transaction)
WRITE_ONCE(jh->b_next_transaction, NULL)
__jbd2_journal_file_buffer(jh, BJ_Reserved)
J_ASSERT_JH(jh, jh->b_frozen_data == NULL) // assertion failure !
The reproducer (See detail in [Link]) reports:
------------[ cut here ]------------
kernel BUG at fs/jbd2/transaction.c:1629!
invalid opcode: 0000 [#1] PREEMPT SMP
CPU: 2 PID: 584 Comm: unlink Tainted: G W
5.19.0-rc6-00115-g4a57a8400075-dirty #697
RIP: 0010:jbd2_journal_dirty_metadata+0x3c5/0x470
RSP: 0018:ffffc90000be7ce0 EFLAGS: 00010202
Call Trace:
__ext4_handle_dirty_metadata+0xa0/0x290
ext4_handle_dirty_dirblock+0x10c/0x1d0
ext4_delete_entry+0x104/0x200
__ext4_unlink+0x22b/0x360
ext4_unlink+0x275/0x390
vfs_unlink+0x20b/0x4c0
do_unlinkat+0x42f/0x4c0
__x64_sys_unlink+0x37/0x50
do_syscall_64+0x35/0x80
After journal aborting, __jbd2_journal_refile_buffer() is executed with
holding @jh->b_state_lock, we can fix it by moving 'is_handle_aborted()'
into the area protected by @jh->b_state_lock.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.2-1 (bookworm) | linux 6.0.2-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 470decc613ab2048b619a01028072d932d9086ee < 0f61c6dc4b714be9d79cf0782ca02ba01c1b7ac3 | 0f61c6dc4b714be9d79cf0782ca02ba01c1b7ac3 |
| linux | linux | >= 470decc613ab2048b619a01028072d932d9086ee < 6073389db83b903678a0920554fa19f5bdc51c48 | 6073389db83b903678a0920554fa19f5bdc51c48 |
| linux | linux | >= 470decc613ab2048b619a01028072d932d9086ee < fa5b65d39332fef7a11ae99cb1f0696012a61527 | fa5b65d39332fef7a11ae99cb1f0696012a61527 |
| linux | linux | >= 470decc613ab2048b619a01028072d932d9086ee < f7161d0da975adc234161cd0641d0e484f5ce375 | f7161d0da975adc234161cd0641d0e484f5ce375 |
| linux | linux | >= 470decc613ab2048b619a01028072d932d9086ee < e62f79827784f56499a50ea2e893c98317b5407b | e62f79827784f56499a50ea2e893c98317b5407b |
| linux | linux | >= 470decc613ab2048b619a01028072d932d9086ee < 731c1662d838fe954c6759e3ee43229b0d928fe4 | 731c1662d838fe954c6759e3ee43229b0d928fe4 |
| linux | linux | >= 470decc613ab2048b619a01028072d932d9086ee < ddd896792e1718cb84c96f3e618270589b6886dc | ddd896792e1718cb84c96f3e618270589b6886dc |
| linux | linux | >= 470decc613ab2048b619a01028072d932d9086ee < 4a734f0869f970b8a9b65062ea40b09a5da9dba8 | 4a734f0869f970b8a9b65062ea40b09a5da9dba8 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.140-1 | 5.10.140-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 2.6.20 < 4.14.291 | 4.14.291 |
| linux | linux_kernel | >= 4.15 < 4.19.256 | 4.19.256 |
| linux | linux_kernel | >= 4.20 < 5.4.211 | 5.4.211 |
| linux | linux_kernel | >= 5.11 < 5.15.61 | 5.15.61 |
| linux | linux_kernel | >= 5.16 < 5.18.18 | 5.18.18 |
| linux | linux_kernel | >= 5.19 < 5.19.2 | 5.19.2 |
| linux | linux_kernel | >= 5.5 < 5.10.137 | 5.10.137 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted
vendor_redhat·2025-06-18·CVSS 5.5
CVE-2022-50126 [MEDIUM] CWE-617 kernel: jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted
kernel: jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted
In the Linux kernel, the following vulnerability has been resolved:
jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted
Following process will fail assertion 'jh->b_frozen_data == NULL' in
jbd2_journal_dirty_metadata():
jbd2_journal_commit_transaction
unlink(dir/a)
jh->b_transaction = trans1
jh->b_jlist = BJ_Metadata
journal->j_running_transaction = NULL
trans1->t_state = T_COMMIT
unlink(dir/b)
handle->h_trans = trans2
do_get_write_access
jh->b_modified = 0
jh->b_frozen_data = frozen_buffer
jh->b_next_transaction = trans2
jbd2_journal_dirty_metadata
is_handle_aborted
is_journal_aborted // return false
--> jbd2 abort t_buffers)
if (is_journal_aborted)
jbd2_journal_refile_buffer
__j
Debian
CVE-2022-50126: linux - In the Linux kernel, the following vulnerability has been resolved: jbd2: fix a...
vendor_debian·2022·CVSS 5.5
CVE-2022-50126 [MEDIUM] CVE-2022-50126: linux - In the Linux kernel, the following vulnerability has been resolved: jbd2: fix a...
In the Linux kernel, the following vulnerability has been resolved: jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted Following process will fail assertion 'jh->b_frozen_data == NULL' in jbd2_journal_dirty_metadata(): jbd2_journal_commit_transaction unlink(dir/a) jh->b_transaction = trans1 jh->b_jlist = BJ_Metadata journal->j_running_transaction = NULL trans1->t_state = T_COMMIT unlink(dir/b) handle->h_trans = trans2 do_get_write_access jh->b_modified = 0 jh->b_frozen_data = frozen_buffer jh->b_next_transaction = trans2 jbd2_journal_dirty_metadata is_handle_aborted is_journal_aborted // return false --> jbd2 abort t_buffers) if (is_journal_aborted) jbd2_journal_refile_buffer __jbd2_journal_refile_buffer WRITE_ONCE(jh->b_transaction, jh->b_next_transaction) WRITE_
OSV
CVE-2022-50126: In the Linux kernel, the following vulnerability has been resolved: jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted Follo
osv·2025-06-18·CVSS 5.5
CVE-2022-50126 [MEDIUM] CVE-2022-50126: In the Linux kernel, the following vulnerability has been resolved: jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted Follo
In the Linux kernel, the following vulnerability has been resolved: jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted Following process will fail assertion 'jh->b_frozen_data == NULL' in jbd2_journal_dirty_metadata(): jbd2_journal_commit_transaction unlink(dir/a) jh->b_transaction = trans1 jh->b_jlist = BJ_Metadata journal->j_running_transaction = NULL trans1->t_state = T_COMMIT unlink(dir/b) handle->h_trans = trans2 do_get_write_access jh->b_modified = 0 jh->b_frozen_data = frozen_buffer jh->b_next_transaction = trans2 jbd2_journal_dirty_metadata is_handle_aborted is_journal_aborted // return false --> jbd2 abort t_buffers) if (is_journal_aborted) jbd2_journal_refile_buffer __jbd2_journal_refile_buffer WRITE_ONCE(jh->b_transaction, jh->b_next_transaction) WRITE_
GHSA
GHSA-w74v-3fr4-63jv: In the Linux kernel, the following vulnerability has been resolved:
jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted
Fol
ghsa_unreviewed·2025-06-18
CVE-2022-50126 [MEDIUM] CWE-617 GHSA-w74v-3fr4-63jv: In the Linux kernel, the following vulnerability has been resolved:
jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted
Fol
In the Linux kernel, the following vulnerability has been resolved:
jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted
Following process will fail assertion 'jh->b_frozen_data == NULL' in
jbd2_journal_dirty_metadata():
jbd2_journal_commit_transaction
unlink(dir/a)
jh->b_transaction = trans1
jh->b_jlist = BJ_Metadata
journal->j_running_transaction = NULL
trans1->t_state = T_COMMIT
unlink(dir/b)
handle->h_trans = trans2
do_get_write_access
jh->b_modified = 0
jh->b_frozen_data = frozen_buffer
jh->b_next_transaction = trans2
jbd2_journal_dirty_metadata
is_handle_aborted
is_journal_aborted // return false
--> jbd2 abort t_buffers)
if (is_journal_aborted)
jbd2_journal_refile_buffer
__jbd2_journal_refile_buffer
WRITE_ONCE(jh->b_transaction,
jh->b_next_transaction)
WR
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/0f61c6dc4b714be9d79cf0782ca02ba01c1b7ac3https://git.kernel.org/stable/c/4a734f0869f970b8a9b65062ea40b09a5da9dba8https://git.kernel.org/stable/c/6073389db83b903678a0920554fa19f5bdc51c48https://git.kernel.org/stable/c/731c1662d838fe954c6759e3ee43229b0d928fe4https://git.kernel.org/stable/c/ddd896792e1718cb84c96f3e618270589b6886dchttps://git.kernel.org/stable/c/e62f79827784f56499a50ea2e893c98317b5407bhttps://git.kernel.org/stable/c/f7161d0da975adc234161cd0641d0e484f5ce375https://git.kernel.org/stable/c/fa5b65d39332fef7a11ae99cb1f0696012a61527
2025-06-18
Published