SECUFOCUSNOW
Home›CVE index›CVE-2022-50581
Review reviewHigh

CVE-2022-50581

Linux

In the Linux kernel, the following vulnerability has been resolved: hfs: fix OOB Read in __hfs_brec_find Syzbot reported a OOB read bug: ================================================================== BUG: KASAN: slab-out-of-bounds in hfs_strcmp+0x117/0x190 fs/hfs/string.c:84 Read of size 1 at addr ffff88807eb62c4e by task kworker/u4:1/11 CPU: 1 PID: 11 Comm: kworker/u4:1 Not tainted 6.1.0-rc6-syzkaller-00308-g644e9524388a #0 Workqueue: writeback wb_workfn (flush-7:0) Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 print_addres...

CVSS
7.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2025.10.22
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: hfs: fix OOB Read in __hfs_brec_find Syzbot reported a OOB read bug: ================================================================== BUG: KASAN: slab-out-of-bounds in hfs_strcmp+0x117/0x190 fs/hfs/string.c:84 Read of size 1 at addr ffff88807eb62c4e by task kworker/u4:1/11 CPU: 1 PID: 11 Comm: kworker/u4:1 Not tainted 6.1.0-rc6-syzkaller-00308-g644e9524388a #0 Workqueue: writeback wb_workfn (flush-7:0) Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 print_addres...

Affected product and versions

Product
Linux
Affected versions
>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 8c40f2dbae603ef0bd21e87c63f54ec59fd88256, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c886c10a6eddb99923b315f42bf63f448883ef9a, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 2344f17c0a89c181ab1a9fef57fd8c3bddfd6e30, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 90103ccb6e60aa4efe48993d23d6a528472f2233, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 4fd3a11804c8877ff11fec59c5c53f1635331e3e, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 367296925c7625c3969d2a78d7a3e1dee161beb5, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < e9e692917c6e10a7066c7a6d092dcdc3d4e329f3, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < bfc9d8f27f89717431a6aecce42ae230b437433f, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 8d824e69d9f3fa3121b2dda25053bae71e2460d2, >= 2.6.12
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Not available