Executive brief
The ext4 filesystem in the Linux kernel contains a use-after-free vulnerability in the ext4_orphan_cleanup function that is triggered during filesystem mounting. When a memory allocation fails during journal inode setup, a freed inode can be reused in subsequent operations, potentially allowing an attacker with local access to crash the system or execute code with kernel privileges.
Technical details
The vulnerability is a use-after-free flaw in the ext4_orphan_cleanup function called during ext4_fill_super. The root cause is improper error handling when ext4_inode_attach_jinode() fails with -ENOMEM: the inode is freed via iput() but the loop continues with a stale reference to the freed inode, which is then passed to list_add(). The attack vector is local (requiring mount capability) and no user interaction is needed. A successful exploit can cause kernel panic or potential code execution via kernel memory corruption. The issue was patched by properly propagating the return value of ext4_inode_attach_jinode() to stop the orphan cleanup loop on error.
Affected products
- Linux Linux kernel before patched version (affecting 6.1.0-rc3 and earlier)
Timeline
- 2025-12-09: disclosed: CVE-2022-50673 published