CVE-2022-50815
Filesystem Size Validation Flaw in Linux ext2 Risks Mount Failures
Publication date: 2025-12-30
Last updated on: 2025-12-30
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel's ext2 filesystem involves missing sanity checks for the filesystem size and group size. Without these checks, it was possible to mount crafted filesystems with extremely large group counts that exceed the underlying device size or have group sizes too small to fit metadata. The fix adds checks to ensure the filesystem size does not exceed the device size and that group size is sufficient for metadata.
How can this vulnerability impact me? :
This vulnerability could allow an attacker to mount specially crafted ext2 filesystems that have invalid sizes or group counts, potentially leading to system instability, crashes, or denial of service due to improper handling of filesystem metadata.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version that includes the fix adding sanity checks for ext2 filesystem group and size. This prevents mounting crafted filesystems with extremely large group counts that could exploit the vulnerability.