CVE-2022-50845ext4: fix inode leak in ext4_xattr_inode_create() on an error path
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ext4: fix inode leak in ext4_xattr_inode_create() on an error path There is issue as follows when do setxattr with inject fault: [localhost]# fsck.ext4 -fn /dev/sda e2fsck 1.46.6-rc1 (12-Sep-2022) Pass 1: Checking inodes, blocks, and sizes Pass 2: Checking directory structure Pass 3: Checking directory connectivity Pass 4: Checking reference counts Unattached zero-length inode 15. Clear? no Unattached inode 15 Connect to /lost+found? no Pass 5: Checking group summary information /dev/sda: ********** WARNING: Filesystem still has errors ********** /dev/sda: 15/655360 files (0.0% non-contiguous), 66755/2621440 blocks This occurs in 'ext4_xattr_inode_create()'. If 'ext4_mark_inode_dirty()' fails, dropping i_nlink of the inode is needed. Or will lead to inode leak.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Deferred
- Record last updated
- May 11, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from bd3b963b273e247e13979f98812a6e4979b5c1e4 before 0f709e08caffb41bbc9b38b9a4c1bd0769794007; from bd3b963b273e247e13979f98812a6e4979b5c1e4 before eab94a46560f68d4bcd15222701ced479f84f427; from bd3b963b273e247e13979f98812a6e4979b5c1e4 before 9ef603086c5b796fde1c7f22a17d0fc826ba54cb; from bd3b963b273e247e13979f98812a6e4979b5c1e4 before 9882601ee689975c1c0076ee65bf222a2a35e535; from bd3b963b273e247e13979f98812a6e4979b5c1e4 before 322cf639b0b7f137543072c55545adab782b3a25; from bd3b963b273e247e13979f98812a6e4979b5c1e4 before fdaaf45786dc8c17a72901021772520fceb18f8c; from bd3b963b273e247e13979f98812a6e4979b5c1e4 before 70e5b46beba64706430a87a6d516054225e8ac8a; from bd3b963b273e247e13979f98812a6e4979b5c1e4 before e4db04f7d3dbbe16680e0ded27ea2a65b10f766a | CNA record |
References
- https://git.kernel.org/stable/c/0f709e08caffb41bbc9b38b9a4c1bd0769794007
- https://git.kernel.org/stable/c/eab94a46560f68d4bcd15222701ced479f84f427
- https://git.kernel.org/stable/c/9ef603086c5b796fde1c7f22a17d0fc826ba54cb
- https://git.kernel.org/stable/c/9882601ee689975c1c0076ee65bf222a2a35e535
- https://git.kernel.org/stable/c/322cf639b0b7f137543072c55545adab782b3a25
- https://git.kernel.org/stable/c/fdaaf45786dc8c17a72901021772520fceb18f8c
- https://git.kernel.org/stable/c/70e5b46beba64706430a87a6d516054225e8ac8a
- https://git.kernel.org/stable/c/e4db04f7d3dbbe16680e0ded27ea2a65b10f766a
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.