CVE-2022-50782 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix bug_on in __es_tree_search caused by bad quota inode
We got a issue as fllows: ================================================================== kernel BUG at fs/ext4/extents_status.c:202! invalid opcode: 0000 [#1] PREEMPT SMP
CPU: 1 PID: 810 Comm: mount Not tainted 6.1.0-rc1-next-g9631525255e3 #352 RIP: 0010:__es_tree_search.isra.0+0xb8/0xe0 RSP: 0018:ffffc90001227900 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000077512a0f RCX: 0000000000000000 RDX: 0000000000000002 RSI: 0000000000002a10 RDI: ffff8881004cd0c8 RBP: ffff888177512ac8 R08: 47ffffffffffffff R09: 0000000000000001 R10: 0000000000000001 R11: 00000000000679af R12: 0000000000002a10 R13: ffff888177512d88 R14: 0000000077512a10 R15: 0000000000000000 FS: 00007f4bd76dbc40(0000)GS:ffff88842fd00000(0000)knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005653bf993cf8 CR3: 000000017bfdf000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ext4_es_cache_extent+0xe2/0x210 ext4_cache_extents+0xd2/0x110 ext4_find_extent+0x5d5/0x8c0 ext4_ext_map_blocks+0x9c/0x1d30 ext4_map_blocks+0x431/0xa50 ext4_getblk+0x82/0x340 ext4_bread+0x14/0x110 ext4_quota_read+0xf0/0x180 v2_read_header+0x24/0x90 v2_check_quota_file+0x2f/0xa0 dquot_load_quota_sb+0x26c/0x760 dquot_load_quota_inode+0xa5/0x190 ext4_enable_quotas+0x14c/0x300 __ext4_fill_super+0x31cc/0x32c0 ext4_fill_super+0x115/0x2d0 get_tree_bdev+0x1d2/0x360 ext4_get_tree+0x19/0x30 vfs_get_tree+0x26/0xe0 path_mount+0x81d/0xfc0 do_mount+0x8d/0xc0 __x64_sys_mount+0xc0/0x160 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> ==================================================================
Above issue may happen as follows: ------------------------------------- ext4_fill_super ext4_orphan_cleanup ext4_enable_quotas ext4_quota_enable ext4_iget --> get error inode <5> ext4_ext_check_inode --> Wrong imode makes it escape inspection make_bad_inode(inode) --> EXT4_BOOT_LOADER_INO set imode dquot_load_quota_inode vfs_setup_quota_inode --> check pass dquot_load_quota_sb v2_check_quota_file v2_read_header ext4_quota_read ext4_bread ext4_getblk ext4_map_blocks ext4_ext_map_blocks ext4_find_extent ext4_cache_extents ext4_es_cache_extent __es_tree_search.isra.0 ext4_es_end --> Wrong extents trigger BUG_ON
In the above issue, s_usr_quota_inum is set to 5, but inode<5> contains incorrect imode and disordered extents. Because 5 is EXT4_BOOT_LOADER_INO, the ext4_ext_check_inode check in the ext4_iget function can be bypassed, finally, the extents that are not checked trigger the BUG_ON in the __es_tree_search function. To solve this issue, check whether the inode is bad_inode in vfs_setup_quota_inode().
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 12/30/2025
The vulnerability described in CVE-2022-50782 affects the Linux kernel's ext4 filesystem implementation and specifically targets a critical flaw in the extent status tree search functionality. This issue manifests as a kernel BUG_ON condition triggered during quota inode processing, which can lead to system crashes and potential denial of service conditions. The vulnerability stems from improper handling of bad inode states during quota file initialization, particularly when dealing with the EXT4_BOOT_LOADER_INO inode number 5. The technical root cause involves a bypass of inode validation checks that should prevent processing of malformed or corrupted inodes. When the ext4 filesystem attempts to load quota information, it encounters an inode with incorrect mode and disordered extents, yet fails to properly identify this as a bad inode during the quota loading process. This failure allows corrupted extent data to propagate through the system, eventually triggering a BUG_ON macro in the __es_tree_search function located in fs/ext4/extents_status.c at line 202. The call trace reveals the complete execution path from mount operations through quota file processing to the final kernel panic, demonstrating how the flaw propagates from the initial filesystem superblock setup through multiple layers of kernel subsystems including extent caching, block mapping, and quota management. The vulnerability directly relates to CWE-691, which addresses insufficient control flow management and improper handling of exceptional conditions in software systems. The issue also aligns with ATT&CK technique T1499.001, which covers the exploitation of system resources through kernel-level vulnerabilities to cause system instability or denial of service. The security implications extend beyond simple system crashes, as this vulnerability could potentially be exploited to gain unauthorized access to system resources or escalate privileges through manipulation of the filesystem's internal data structures. The fix implemented addresses the core problem by adding proper bad inode checking in the vfs_setup_quota_inode function, ensuring that corrupted inodes are properly identified and rejected before they can cause damage to the filesystem's extent management system. This mitigation strategy prevents the propagation of malformed extent data through the kernel's extent tree search functionality and maintains system stability during quota file processing operations. The vulnerability highlights the importance of robust input validation and proper error handling in kernel space, particularly when dealing with critical system resources like filesystem metadata and quota management structures.