CoreCVE
Back

HIGH

fs: fix UAF/GPF bug in nilfs_mdt_destroy

Published Sep 17, 2025

Description

In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc() fails, which causes inode->i_private uninitialized. Then nilfs_is_metadata_file_inode() returns true and nilfs_free_inode() wrongly calls nilfs_mdt_destroy(), which frees the uninitialized inode->i_private and leads to crashes(e.g., UAF/GPF).

Fix this by moving security_inode_alloc just prior to this_cpu_inc(nr_inodes)

Affected products

Remediation

Red Hat statement

This patch fixes a use-after-free/GPF bug in the NILFS2 metadata handling. When security_inode_alloc() failed, an uninitialized inode->i_private pointer could later be freed by nilfs_mdt_destroy(), leading to memory corruption or crashes. You can reproduce this issue on systems using NILFS, because the crash path involves nilfs_mdt_destroy() freeing inode->i_private when security_inode_alloc() fails. On other filesystems the same cleanup path does not run, so accidental freeing of that uninitialized field is far less likely. Consequently, systems not using NILFS are at much lower risk unless they have other code that similarly frees inode->i_private. For the all versions of the Red Hat Enterprise Linux the config param CONFIG_NILFS2_FS disabled, so with the known scenario of attack it is not affected.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (1)

CWE-416

Use After Free

References (14)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Linux
Published Sep 17, 2025
Updated Aug 5, 2026
Reserved Sep 17, 2025
Link CVE-2022-50367
CISA Vulnrichment
Updated Jan 14, 2026
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2022-50367
Red Hat
Severity Moderate
Public date Sep 17, 2025
Links CVE-2022-50367 - Bugzilla
ENISA EUVD
Assigner n/a
Published n/a
Updated n/a
Exploited since n/a
Link n/a