Review reviewHigh

CVE-2022-50746

Linux

In the Linux kernel, the following vulnerability has been resolved: erofs: validate the extent length for uncompressed pclusters syzkaller reported a KASAN use-after-free: https://syzkaller.appspot.com/bug?extid=2ae90e873e97f1faf6f2 The referenced fuzzed image actually has two issues: - m_pa == 0 as a non-inlined pcluster; - The logical length is longer than its physical length. The first issue has already been addressed. This patch addresses the second issue by checking the extent length validity.

CVSS: 8.4
EPSS: 0.18%
CISA KEV: Not listed
Published: 2025.12.24

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.18%

Technical severityCVSS 8.4

Vulnerability overview

Affected product and versions

Product: Linux
Affected versions: >= 02827e1796b33f1794966f5c3101f8da2dfa9c1d < dc8b6bd587b13b85aff6e9d36cdfcd3f955cac9e, >= 02827e1796b33f1794966f5c3101f8da2dfa9c1d < 40c73b2ea9611b5388807be406f30f5e4e1162da, >= 02827e1796b33f1794966f5c3101f8da2dfa9c1d < c505feba4c0d76084e56ec498ce819f02a7043ae, >= 4.19
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: Not available