CVE-2022-49255 in Linux
Summary
by MITRE • 02/26/2025
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix missing free nid in f2fs_handle_failed_inode
This patch fixes xfstests/generic/475 failure.
[ 293.680694] F2FS-fs (dm-1): May loss orphan inode, run fsck to fix.
[ 293.685358] Buffer I/O error on dev dm-1, logical block 8388592, async page read
[ 293.691527] Buffer I/O error on dev dm-1, logical block 8388592, async page read
[ 293.691764] sh (7615): drop_caches: 3
[ 293.691819] sh (7616): drop_caches: 3
[ 293.694017] Buffer I/O error on dev dm-1, logical block 1, async page read
[ 293.695659] sh (7618): drop_caches: 3
[ 293.696979] sh (7617): drop_caches: 3
[ 293.700290] sh (7623): drop_caches: 3
[ 293.708621] sh (7626): drop_caches: 3
[ 293.711386] sh (7628): drop_caches: 3
[ 293.711825] sh (7627): drop_caches: 3
[ 293.716738] sh (7630): drop_caches: 3
[ 293.719613] sh (7632): drop_caches: 3
[ 293.720971] sh (7633): drop_caches: 3
[ 293.727741] sh (7634): drop_caches: 3
[ 293.730783] sh (7636): drop_caches: 3
[ 293.732681] sh (7635): drop_caches: 3
[ 293.732988] sh (7637): drop_caches: 3
[ 293.738836] sh (7639): drop_caches: 3
[ 293.740568] sh (7641): drop_caches: 3
[ 293.743053] sh (7640): drop_caches: 3
[ 293.821889] ------------[ cut here ]------------
[ 293.824654] kernel BUG at fs/f2fs/node.c:3334!
[ 293.826226] invalid opcode: 0000 [#1] PREEMPT SMP PTI
[ 293.828713] CPU: 0 PID: 7653 Comm: umount Tainted: G OE 5.17.0-rc1-custom #1
[ 293.830946] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
[ 293.832526] RIP: 0010:f2fs_destroy_node_manager+0x33f/0x350 [f2fs]
[ 293.833905] Code: e8 d6 3d f9 f9 48 8b 45 d0 65 48 2b 04 25 28 00 00 00 75 1a 48 81 c4 28 03 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b
[ 293.837783] RSP: 0018:ffffb04ec31e7a20 EFLAGS: 00010202
[ 293.839062] RAX: 0000000000000001 RBX: ffff9df947db2eb8 RCX: 0000000080aa0072
[ 293.840666] RDX: 0000000000000000 RSI: ffffe86c0432a140 RDI: ffffffffc0b72a21
[ 293.842261] RBP: ffffb04ec31e7d70 R08: ffff9df94ca85780 R09: 0000000080aa0072
[ 293.843909] R10: ffff9df94ca85700 R11: ffff9df94e1ccf58 R12: ffff9df947db2e00
[ 293.845594] R13: ffff9df947db2ed0 R14: ffff9df947db2eb8 R15: ffff9df947db2eb8
[ 293.847855] FS: 00007f5a97379800(0000) GS:ffff9dfa77c00000(0000) knlGS:0000000000000000
[ 293.850647] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 293.852940] CR2: 00007f5a97528730 CR3: 000000010bc76005 CR4: 0000000000370ef0
[ 293.854680] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 293.856423] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 293.858380] Call Trace:
[ 293.859302]
[ 293.860311] ? ttwu_do_wakeup+0x1c/0x170
[ 293.861800] ? ttwu_do_activate+0x6d/0xb0
[ 293.863057] ? _raw_spin_unlock_irqrestore+0x29/0x40
[ 293.864411] ? try_to_wake_up+0x9d/0x5e0
[ 293.865618] ? debug_smp_processor_id+0x17/0x20
[ 293.866934] ? debug_smp_processor_id+0x17/0x20
[ 293.868223] ? free_unref_page+0xbf/0x120
[ 293.869470] ? __free_slab+0xcb/0x1c0
[ 293.870614] ? preempt_count_add+0x7a/0xc0
[ 293.871811] ? __slab_free+0xa0/0x2d0
[ 293.872918] ? __wake_up_common_lock+0x8a/0xc0
[ 293.874186] ? __slab_free+0xa0/0x2d0
[ 293.875305] ? free_inode_nonrcu+0x20/0x20
[ 293.876466] ? free_inode_nonrcu+0x20/0x20
[ 293.877650] ? debug_smp_processor_id+0x17/0x20
[ 293.878949] ? call_rcu+0x11a/0x240
[ 293.880060] ? f2fs_destroy_stats+0x59/0x60 [f2fs]
[ 293.881437] ? kfree+0x1fe/0x230
[ 293.882674] f2fs_put_super+0x160/0x390 [f2fs]
[ 293.883978] generic_shutdown_super+0x7a/0x120
[ 293.885274] kill_block_super+0x27/0x50
[ 293.886496] kill_f2fs_super+0x7f/0x100 [f2fs]
[ 293.887806] deactivate_locked_super+0x35/0xa0
[ 293.889271] deactivate_super+0x40/0x50
[ 293.890513] cleanup_mnt+0x139/0x190
[ 293.891689] __cleanup_mnt+0x12/0x20
[ 293.892850] task_work_run+0x64/0xa0
[ 293.894035] exit_to_user_mode_prepare+0x1b7/
---truncated---
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2025
The vulnerability CVE-2022-49255 resides within the F2FS (Flash-Friendly File System) implementation in the Linux kernel, specifically in the function f2fs_handle_failed_inode. This flaw manifests as a missing free nid (node identifier) during the handling of failed inodes, which can lead to resource exhaustion and system instability. The issue was identified through xfstests/generic/475 failure, indicating a regression in the test suite that validates F2FS behavior under various stress conditions. The root cause involves improper cleanup of node identifiers when inode handling fails, resulting in orphaned entries that persist in the system's metadata structures.
The technical exploitation of this vulnerability begins with an inode failure scenario, typically triggered during write operations or filesystem corruption events. When f2fs_handle_failed_inode is invoked, it attempts to clean up failed inodes but fails to properly release the associated node identifiers. This oversight leads to a memory leak in the node manager subsystem, where freed node entries remain in a limbo state. The kernel logs indicate buffer I/O errors occurring at specific logical block addresses, suggesting that the filesystem is attempting to access corrupted or improperly managed storage regions. The subsequent kernel BUG at fs/f2fs/node.c line 3334 represents a critical failure point where the system attempts to access invalid memory regions due to the corrupted node identifier management. This condition ultimately leads to a kernel panic and system crash, as evidenced by the invalid opcode error and subsequent system termination.
The operational impact of CVE-2022-49255 extends beyond simple resource leakage to encompass complete system reliability concerns. In production environments, this vulnerability can cause filesystem corruption, data loss, and unexpected system crashes during normal operations. The issue particularly affects systems heavily reliant on F2FS, such as embedded devices, mobile platforms, and systems using virtualized storage environments. The behavior aligns with CWE-401: "Improper Release of Memory" and manifests as a memory management failure within the kernel's storage subsystem. From an ATT&CK perspective, this vulnerability maps to T1490: "Inhibit System Recovery" and T1565.001: "Data Manipulation" as it can cause system instability and data corruption. The vulnerability is particularly concerning because it can be triggered through normal filesystem operations, making it a latent threat that may not be immediately apparent during routine system monitoring.
Mitigation strategies for CVE-2022-49255 center on applying the kernel patch that resolves the missing free nid issue in f2fs_handle_failed_inode. System administrators should prioritize updating to kernel versions containing the fix, particularly those incorporating the upstream patch that ensures proper node identifier cleanup during inode failure scenarios. Additionally, implementing proactive filesystem monitoring and regular fsck operations can help identify and recover from potential corruption states before they escalate to system crashes. The patch addresses the core issue by ensuring that all node identifiers associated with failed inodes are properly freed during cleanup operations, preventing the accumulation of orphaned entries in the node manager. Organizations should also consider implementing robust backup and recovery procedures for systems running F2FS, given the potential for data loss and system instability. Monitoring for buffer I/O errors and kernel BUG reports should be part of routine system maintenance to detect early signs of this vulnerability's manifestation.