CVE-2022-50845
published 2025-12-30CVE-2022-50845: In the Linux kernel, the following vulnerability has been resolved: ext4: fix inode leak in ext4_xattr_inode_create() on an error path There is issue as…
PriorityP422low5.5
EPSS
0.22%
12.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix inode leak in ext4_xattr_inode_create() on an error path
There is issue as follows when do setxattr with inject fault:
[localhost]# fsck.ext4 -fn /dev/sda
e2fsck 1.46.6-rc1 (12-Sep-2022)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Unattached zero-length inode 15. Clear? no
Unattached inode 15
Connect to /lost+found? no
Pass 5: Checking group summary information
/dev/sda: ********** WARNING: Filesystem still has errors **********
/dev/sda: 15/655360 files (0.0% non-contiguous), 66755/2621440 blocks
This occurs in 'ext4_xattr_inode_create()'. If 'ext4_mark_inode_dirty()'
fails, dropping i_nlink of the inode is needed. Or will lead to inode leak.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.4-1 (bookworm) | linux 6.1.4-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= bd3b963b273e247e13979f98812a6e4979b5c1e4 < 0f709e08caffb41bbc9b38b9a4c1bd0769794007 | 0f709e08caffb41bbc9b38b9a4c1bd0769794007 |
| linux | linux | >= bd3b963b273e247e13979f98812a6e4979b5c1e4 < eab94a46560f68d4bcd15222701ced479f84f427 | eab94a46560f68d4bcd15222701ced479f84f427 |
| linux | linux | >= bd3b963b273e247e13979f98812a6e4979b5c1e4 < 9ef603086c5b796fde1c7f22a17d0fc826ba54cb | 9ef603086c5b796fde1c7f22a17d0fc826ba54cb |
| linux | linux | >= bd3b963b273e247e13979f98812a6e4979b5c1e4 < 9882601ee689975c1c0076ee65bf222a2a35e535 | 9882601ee689975c1c0076ee65bf222a2a35e535 |
| linux | linux | >= bd3b963b273e247e13979f98812a6e4979b5c1e4 < 322cf639b0b7f137543072c55545adab782b3a25 | 322cf639b0b7f137543072c55545adab782b3a25 |
| linux | linux | >= bd3b963b273e247e13979f98812a6e4979b5c1e4 < fdaaf45786dc8c17a72901021772520fceb18f8c | fdaaf45786dc8c17a72901021772520fceb18f8c |
| linux | linux | >= bd3b963b273e247e13979f98812a6e4979b5c1e4 < 70e5b46beba64706430a87a6d516054225e8ac8a | 70e5b46beba64706430a87a6d516054225e8ac8a |
| linux | linux | >= bd3b963b273e247e13979f98812a6e4979b5c1e4 < e4db04f7d3dbbe16680e0ded27ea2a65b10f766a | e4db04f7d3dbbe16680e0ded27ea2a65b10f766a |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 4.13.0 < 4.14.303 | 4.14.303 |
| linux | linux_kernel | >= 4.15.0 < 4.19.270 | 4.19.270 |
| linux | linux_kernel | >= 4.20.0 < 5.4.229 | 5.4.229 |
| linux | linux_kernel | >= 5.11.0 < 5.15.87 | 5.15.87 |
| linux | linux_kernel | >= 5.16.0 < 6.0.18 | 6.0.18 |
| linux | linux_kernel | >= 5.5.0 < 5.10.163 | 5.10.163 |
| linux | linux_kernel | >= 6.1.0 < 6.1.4 | 6.1.4 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: Linux kernel (ext4): Denial of Service due to inode leak via failed extended attribute creation
vendor_redhat·2025-12-30·CVSS 5.5
CVE-2022-50845 [LOW] CWE-772 kernel: Linux kernel (ext4): Denial of Service due to inode leak via failed extended attribute creation
kernel: Linux kernel (ext4): Denial of Service due to inode leak via failed extended attribute creation
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix inode leak in ext4_xattr_inode_create() on an error path
There is issue as follows when do setxattr with inject fault:
[localhost]# fsck.ext4 -fn /dev/sda
e2fsck 1.46.6-rc1 (12-Sep-2022)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Unattached zero-length inode 15. Clear? no
Unattached inode 15
Connect to /lost+found? no
Pass 5: Checking group summary information
/dev/sda: ********** WARNING: Filesystem still has errors **********
/dev/sda: 15/655360 files (0.0% non-contiguous), 66755/2621440 blocks
This
Debian
CVE-2022-50845: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: fix i...
vendor_debian·2022
CVE-2022-50845 CVE-2022-50845: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: fix i...
In the Linux kernel, the following vulnerability has been resolved: ext4: fix inode leak in ext4_xattr_inode_create() on an error path There is issue as follows when do setxattr with inject fault: [localhost]# fsck.ext4 -fn /dev/sda e2fsck 1.46.6-rc1 (12-Sep-2022) Pass 1: Checking inodes, blocks, and sizes Pass 2: Checking directory structure Pass 3: Checking directory connectivity Pass 4: Checking reference counts Unattached zero-length inode 15. Clear? no Unattached inode 15 Connect to /lost+found? no Pass 5: Checking group summary information /dev/sda: ********** WARNING: Filesystem still has errors ********** /dev/sda: 15/655360 files (0.0% non-contiguous), 66755/2621440 blocks This occurs in 'ext4_xattr_inode_create()'. If 'ext4_mark_inode_dirty()' fails, dropping i_nlink of the inode
VulDB
Linux Kernel up to 6.1.3 ext4 ext4_xattr_inode_create reference count (Nessus ID 281554 / WID-SEC-2025-2941)
vuldb·2026-04-26
CVE-2022-50845 [CRITICAL] Linux Kernel up to 6.1.3 ext4 ext4_xattr_inode_create reference count (Nessus ID 281554 / WID-SEC-2025-2941)
A vulnerability described as critical has been identified in Linux Kernel up to 6.1.3. This affects the function ext4_xattr_inode_create of the component ext4. Executing a manipulation can lead to improper update of reference count.
This vulnerability is handled as CVE-2022-50845. The attack can only be done within the local network. There is not any exploit available.
Upgrading the affected component is recommended.
GHSA
GHSA-cmjr-fqjm-v74q: In the Linux kernel, the following vulnerability has been resolved:
ext4: fix inode leak in ext4_xattr_inode_create() on an error path
There is issu
ghsa_unreviewed·2025-12-30
CVE-2022-50845 GHSA-cmjr-fqjm-v74q: In the Linux kernel, the following vulnerability has been resolved:
ext4: fix inode leak in ext4_xattr_inode_create() on an error path
There is issu
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix inode leak in ext4_xattr_inode_create() on an error path
There is issue as follows when do setxattr with inject fault:
[localhost]# fsck.ext4 -fn /dev/sda
e2fsck 1.46.6-rc1 (12-Sep-2022)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Unattached zero-length inode 15. Clear? no
Unattached inode 15
Connect to /lost+found? no
Pass 5: Checking group summary information
/dev/sda: ********** WARNING: Filesystem still has errors **********
/dev/sda: 15/655360 files (0.0% non-contiguous), 66755/2621440 blocks
This occurs in 'ext4_xattr_inode_create()'. If 'ext4_mark_inode_dirty()'
fails, dropping i_nlink of t
OSV
ext4: fix inode leak in ext4_xattr_inode_create() on an error path
osv·2025-12-30
CVE-2022-50845 ext4: fix inode leak in ext4_xattr_inode_create() on an error path
ext4: fix inode leak in ext4_xattr_inode_create() on an error path
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix inode leak in ext4_xattr_inode_create() on an error path
There is issue as follows when do setxattr with inject fault:
[localhost]# fsck.ext4 -fn /dev/sda
e2fsck 1.46.6-rc1 (12-Sep-2022)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Unattached zero-length inode 15. Clear? no
Unattached inode 15
Connect to /lost+found? no
Pass 5: Checking group summary information
/dev/sda: ********** WARNING: Filesystem still has errors **********
/dev/sda: 15/655360 files (0.0% non-contiguous), 66755/2621440 blocks
This occurs in 'ext4_xattr_inode_
OSV
CVE-2022-50845: In the Linux kernel, the following vulnerability has been resolved: ext4: fix inode leak in ext4_xattr_inode_create() on an error path There is issue
osv·2025-12-30
CVE-2022-50845 CVE-2022-50845: In the Linux kernel, the following vulnerability has been resolved: ext4: fix inode leak in ext4_xattr_inode_create() on an error path There is issue
In the Linux kernel, the following vulnerability has been resolved: ext4: fix inode leak in ext4_xattr_inode_create() on an error path There is issue as follows when do setxattr with inject fault: [localhost]# fsck.ext4 -fn /dev/sda e2fsck 1.46.6-rc1 (12-Sep-2022) Pass 1: Checking inodes, blocks, and sizes Pass 2: Checking directory structure Pass 3: Checking directory connectivity Pass 4: Checking reference counts Unattached zero-length inode 15. Clear? no Unattached inode 15 Connect to /lost+found? no Pass 5: Checking group summary information /dev/sda: ********** WARNING: Filesystem still has errors ********** /dev/sda: 15/655360 files (0.0% non-contiguous), 66755/2621440 blocks This occurs in 'ext4_xattr_inode_create()'. If 'ext4_mark_inode_dirty()' fails, dropping i_nlink of the inode
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2022-50845 kernel: Linux kernel (ext4): Denial of Service due to inode leak via failed extended attribute creation
bugzilla·2025-12-30
CVE-2022-50845 [LOW] CVE-2022-50845 kernel: Linux kernel (ext4): Denial of Service due to inode leak via failed extended attribute creation
CVE-2022-50845 kernel: Linux kernel (ext4): Denial of Service due to inode leak via failed extended attribute creation
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix inode leak in ext4_xattr_inode_create() on an error path
There is issue as follows when do setxattr with inject fault:
[localhost]# fsck.ext4 -fn /dev/sda
e2fsck 1.46.6-rc1 (12-Sep-2022)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Unattached zero-length inode 15. Clear? no
Unattached inode 15
Connect to /lost+found? no
Pass 5: Checking group summary information
/dev/sda: ********** WARNING: Filesystem still has errors **********
/dev/sda: 15/655360 files (0.0% non-contiguous), 667
Wiz
CVE-2022-50845 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2022-50845 CVE-2022-50845 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2022-50845 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix inode leak in ext4_xattr_inode_create() on an error path
There is issue as follows when do setxattr with inject fault:
[localhost]# fsck.ext4 -fn /dev/sda
e2fsck 1.46.6-rc1 (12-Sep-2022)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Unattached zero-length inode 15. Clear? no
Unattached inode 15
Connect to /lost+found? no
Pass 5: Checking group summary information
/dev/sda: ********** WARNING: Filesystem still has errors **********
/dev/sda: 15/655360 files (0.0% non-contiguous), 66755/2621440 blocks
This occurs in 'ext4_xattr_i
https://git.kernel.org/stable/c/0f709e08caffb41bbc9b38b9a4c1bd0769794007https://git.kernel.org/stable/c/322cf639b0b7f137543072c55545adab782b3a25https://git.kernel.org/stable/c/70e5b46beba64706430a87a6d516054225e8ac8ahttps://git.kernel.org/stable/c/9882601ee689975c1c0076ee65bf222a2a35e535https://git.kernel.org/stable/c/9ef603086c5b796fde1c7f22a17d0fc826ba54cbhttps://git.kernel.org/stable/c/e4db04f7d3dbbe16680e0ded27ea2a65b10f766ahttps://git.kernel.org/stable/c/eab94a46560f68d4bcd15222701ced479f84f427https://git.kernel.org/stable/c/fdaaf45786dc8c17a72901021772520fceb18f8c
2025-12-30
Published