CVE-2022-50864
published 2025-12-30CVE-2022-50864: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix shift-out-of-bounds due to too large exponent of block size If field…
PriorityP422high7.5
EPSS
0.18%
7.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix shift-out-of-bounds due to too large exponent of block size
If field s_log_block_size of superblock data is corrupted and too large,
init_nilfs() and load_nilfs() still can trigger a shift-out-of-bounds
warning followed by a kernel panic (if panic_on_warn is set):
shift exponent 38973 is too large for 32-bit type 'int'
Call Trace:
dump_stack_lvl+0xcd/0x134
ubsan_epilogue+0xb/0x50
__ubsan_handle_shift_out_of_bounds.cold.12+0x17b/0x1f5
init_nilfs.cold.11+0x18/0x1d [nilfs2]
nilfs_mount+0x9b5/0x12b0 [nilfs2]
...
This fixes the issue by adding and using a new helper function for getting
block size with sanity check.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.4-1 (bookworm) | linux 6.1.4-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 8a9d2191e9f43bbcd256a9a6871bd73434c83f2f < ec93b5430ec0f60877a5388bb023d60624f9ab9f | ec93b5430ec0f60877a5388bb023d60624f9ab9f |
| linux | linux | >= 8a9d2191e9f43bbcd256a9a6871bd73434c83f2f < 8b6ef451b5701b37d9a5905534595776a662edfc | 8b6ef451b5701b37d9a5905534595776a662edfc |
| linux | linux | >= 8a9d2191e9f43bbcd256a9a6871bd73434c83f2f < ddb6615a168f97b91175e00eda4c644741cf531c | ddb6615a168f97b91175e00eda4c644741cf531c |
| linux | linux | >= 8a9d2191e9f43bbcd256a9a6871bd73434c83f2f < a16731fa1b96226c75bbf18e73513b14fc318360 | a16731fa1b96226c75bbf18e73513b14fc318360 |
| linux | linux | >= 8a9d2191e9f43bbcd256a9a6871bd73434c83f2f < ebeccaaef67a4895d2496ab8d9c2fb8d89201211 | ebeccaaef67a4895d2496ab8d9c2fb8d89201211 |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 2.6.30 < 5.10.163 | 5.10.163 |
| linux | linux_kernel | >= 5.11.0 < 5.15.86 | 5.15.86 |
| linux | linux_kernel | >= 5.16.0 < 6.0.16 | 6.0.16 |
| linux | linux_kernel | >= 6.1.0 < 6.1.2 | 6.1.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: nilfs2: fix shift-out-of-bounds due to too large exponent of block size
vendor_redhat·2025-12-30
CVE-2022-50864 kernel: nilfs2: fix shift-out-of-bounds due to too large exponent of block size
kernel: nilfs2: fix shift-out-of-bounds due to too large exponent of block size
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix shift-out-of-bounds due to too large exponent of block size
If field s_log_block_size of superblock data is corrupted and too large,
init_nilfs() and load_nilfs() still can trigger a shift-out-of-bounds
warning followed by a kernel panic (if panic_on_warn is set):
shift exponent 38973 is too large for 32-bit type 'int'
Call Trace:
dump_stack_lvl+0xcd/0x134
ubsan_epilogue+0xb/0x50
__ubsan_handle_shift_out_of_bounds.cold.12+0x17b/0x1f5
init_nilfs.cold.11+0x18/0x1d [nilfs2]
nilfs_mount+0x9b5/0x12b0 [nilfs2]
...
This fixes the issue by adding and using a new helper function for getting
block size with sanity check.
Package: kernel (R
Debian
CVE-2022-50864: linux - In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix...
vendor_debian·2022
CVE-2022-50864 CVE-2022-50864: linux - In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix...
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix shift-out-of-bounds due to too large exponent of block size If field s_log_block_size of superblock data is corrupted and too large, init_nilfs() and load_nilfs() still can trigger a shift-out-of-bounds warning followed by a kernel panic (if panic_on_warn is set): shift exponent 38973 is too large for 32-bit type 'int' Call Trace: dump_stack_lvl+0xcd/0x134 ubsan_epilogue+0xb/0x50 __ubsan_handle_shift_out_of_bounds.cold.12+0x17b/0x1f5 init_nilfs.cold.11+0x18/0x1d [nilfs2] nilfs_mount+0x9b5/0x12b0 [nilfs2] ... This fixes the issue by adding and using a new helper function for getting block size with sanity check.
Scope: local
bookworm: resolved (fixed in 6.1.4-1)
bullseye: resolved (fixed in 5.10.178-1)
forky: re
OSV
CVE-2022-50864: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix shift-out-of-bounds due to too large exponent of block size If field s
osv·2025-12-30
CVE-2022-50864 CVE-2022-50864: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix shift-out-of-bounds due to too large exponent of block size If field s
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix shift-out-of-bounds due to too large exponent of block size If field s_log_block_size of superblock data is corrupted and too large, init_nilfs() and load_nilfs() still can trigger a shift-out-of-bounds warning followed by a kernel panic (if panic_on_warn is set): shift exponent 38973 is too large for 32-bit type 'int' Call Trace: dump_stack_lvl+0xcd/0x134 ubsan_epilogue+0xb/0x50 __ubsan_handle_shift_out_of_bounds.cold.12+0x17b/0x1f5 init_nilfs.cold.11+0x18/0x1d [nilfs2] nilfs_mount+0x9b5/0x12b0 [nilfs2] ... This fixes the issue by adding and using a new helper function for getting block size with sanity check.
OSV
nilfs2: fix shift-out-of-bounds due to too large exponent of block size
osv·2025-12-30
CVE-2022-50864 nilfs2: fix shift-out-of-bounds due to too large exponent of block size
nilfs2: fix shift-out-of-bounds due to too large exponent of block size
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix shift-out-of-bounds due to too large exponent of block size
If field s_log_block_size of superblock data is corrupted and too large,
init_nilfs() and load_nilfs() still can trigger a shift-out-of-bounds
warning followed by a kernel panic (if panic_on_warn is set):
shift exponent 38973 is too large for 32-bit type 'int'
Call Trace:
dump_stack_lvl+0xcd/0x134
ubsan_epilogue+0xb/0x50
__ubsan_handle_shift_out_of_bounds.cold.12+0x17b/0x1f5
init_nilfs.cold.11+0x18/0x1d [nilfs2]
nilfs_mount+0x9b5/0x12b0 [nilfs2]
...
This fixes the issue by adding and using a new helper function for getting
block size with sanity check.
GHSA
GHSA-gfhq-qmg6-x4ch: In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix shift-out-of-bounds due to too large exponent of block size
If field
ghsa_unreviewed·2025-12-30
CVE-2022-50864 GHSA-gfhq-qmg6-x4ch: In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix shift-out-of-bounds due to too large exponent of block size
If field
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix shift-out-of-bounds due to too large exponent of block size
If field s_log_block_size of superblock data is corrupted and too large,
init_nilfs() and load_nilfs() still can trigger a shift-out-of-bounds
warning followed by a kernel panic (if panic_on_warn is set):
shift exponent 38973 is too large for 32-bit type 'int'
Call Trace:
dump_stack_lvl+0xcd/0x134
ubsan_epilogue+0xb/0x50
__ubsan_handle_shift_out_of_bounds.cold.12+0x17b/0x1f5
init_nilfs.cold.11+0x18/0x1d [nilfs2]
nilfs_mount+0x9b5/0x12b0 [nilfs2]
...
This fixes the issue by adding and using a new helper function for getting
block size with sanity check.
No detection rules found.
Nuclei
Razer Sila Gaming Router 2.0.441_api-2.0.418 - Local File Inclusion
nuclei·CVSS 7.5
CVE-2022-29014 [HIGH] Razer Sila Gaming Router 2.0.441_api-2.0.418 - Local File Inclusion
Razer Sila Gaming Router 2.0.441_api-2.0.418 - Local File Inclusion
Razer Sila Gaming Router 2.0.441_api-2.0.418 is vulnerable to local file inclusion which could allow attackers to read arbitrary files.
Template:
id: CVE-2022-29014
info:
name: Razer Sila Gaming Router 2.0.441_api-2.0.418 - Local File Inclusion
author: edoardottt
severity: high
description: Razer Sila Gaming Router 2.0.441_api-2.0.418 is vulnerable to local file inclusion which could allow attackers to read arbitrary files.
impact: |
Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the system.
remediation: |
Apply the latest firmware update provided by Razer to fix the Local File Inclusion vulnerability.
reference:
- https://www.exploit-db.com/exploits/50864
- https://nvd
Bugzilla
CVE-2022-50864 kernel: nilfs2: fix shift-out-of-bounds due to too large exponent of block size
bugzilla·2025-12-30
CVE-2022-50864 CVE-2022-50864 kernel: nilfs2: fix shift-out-of-bounds due to too large exponent of block size
CVE-2022-50864 kernel: nilfs2: fix shift-out-of-bounds due to too large exponent of block size
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix shift-out-of-bounds due to too large exponent of block size
If field s_log_block_size of superblock data is corrupted and too large,
init_nilfs() and load_nilfs() still can trigger a shift-out-of-bounds
warning followed by a kernel panic (if panic_on_warn is set):
shift exponent 38973 is too large for 32-bit type 'int'
Call Trace:
dump_stack_lvl+0xcd/0x134
ubsan_epilogue+0xb/0x50
__ubsan_handle_shift_out_of_bounds.cold.12+0x17b/0x1f5
init_nilfs.cold.11+0x18/0x1d [nilfs2]
nilfs_mount+0x9b5/0x12b0 [nilfs2]
...
This fixes the issue by adding and using a new helper function for getting
block size with sanity check.
Wiz
CVE-2022-50864 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2022-50864 CVE-2022-50864 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2022-50864 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix shift-out-of-bounds due to too large exponent of block size
If field s_log_block_size of superblock data is corrupted and too large,
init_nilfs() and load_nilfs() still can trigger a shift-out-of-bounds
warning followed by a kernel panic (if panic_on_warn is set):
shift exponent 38973 is too large for 32-bit type 'int'
Call Trace: dump_stack_lvl+0xcd/0x134
ubsan_epilogue+0xb/0x50
__ubsan_handle_shift_out_of_bounds.cold.12+0x17b/0x1f5
init_nilfs.cold.11+0x18/0x1d [nilfs2]
nilfs_mount+0x9b5/0x12b0 [nilfs2]
...
This fixes the issue by adding and using a new helper function for getting
block size with sanity check.
Source : NVD
Published
https://git.kernel.org/stable/c/8b6ef451b5701b37d9a5905534595776a662edfchttps://git.kernel.org/stable/c/a16731fa1b96226c75bbf18e73513b14fc318360https://git.kernel.org/stable/c/ddb6615a168f97b91175e00eda4c644741cf531chttps://git.kernel.org/stable/c/ebeccaaef67a4895d2496ab8d9c2fb8d89201211https://git.kernel.org/stable/c/ec93b5430ec0f60877a5388bb023d60624f9ab9f
2025-12-30
Published