cbcvebase.
CVE-2022-50436
published 2025-10-01

CVE-2022-50436: In the Linux kernel, the following vulnerability has been resolved: ext4: don't set up encryption key during jbd2 transaction Commit a80f7fcf1867 ("ext4: fixup…

PriorityP419medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.10%
0.8th percentile
In the Linux kernel, the following vulnerability has been resolved: ext4: don't set up encryption key during jbd2 transaction Commit a80f7fcf1867 ("ext4: fixup ext4_fc_track_* functions' signature") extended the scope of the transaction in ext4_unlink() too far, making it include the call to ext4_find_entry(). However, ext4_find_entry() can deadlock when called from within a transaction because it may need to set up the directory's encryption key. Fix this by restoring the transaction to its original scope.

Affected

16 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.4-1 (bookworm)linux 6.1.4-1 (bookworm)
linuxlinux——
linuxlinux>= a80f7fcf18672ae4971a6b713b58c0d389aa99fe < 23ad034760dd38e12b0e0e1b28b9629f330810a123ad034760dd38e12b0e0e1b28b9629f330810a1
linuxlinux>= a80f7fcf18672ae4971a6b713b58c0d389aa99fe < 6220ec405571ded17efedc56587190b542adf2466220ec405571ded17efedc56587190b542adf246
linuxlinux>= a80f7fcf18672ae4971a6b713b58c0d389aa99fe < 206dd3acfb9bca54a25b228c7c7c2257eedde09b206dd3acfb9bca54a25b228c7c7c2257eedde09b
linuxlinux>= a80f7fcf18672ae4971a6b713b58c0d389aa99fe < 1ba993208bcfd691e241483420a2a761d3f157501ba993208bcfd691e241483420a2a761d3f15750
linuxlinux>= a80f7fcf18672ae4971a6b713b58c0d389aa99fe < 4c0d5778385cb3618ff26a561ce41de2b7d9de704c0d5778385cb3618ff26a561ce41de2b7d9de70
linuxlinux_kernel——
linuxlinux_kernel>= 0 < 5.10.178-15.10.178-1
linuxlinux_kernel>= 0 < 6.1.4-16.1.4-1
linuxlinux_kernel>= 0 < 6.1.4-16.1.4-1
linuxlinux_kernel>= 0 < 6.1.4-16.1.4-1
linuxlinux_kernel>= 5.10.1 < 5.10.1635.10.163
linuxlinux_kernel>= 5.11 < 5.15.875.15.87
linuxlinux_kernel>= 5.16 < 6.0.186.0.18
linuxlinux_kernel>= 6.1 < 6.1.46.1.4

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.