CVE-2022-49834nilfs2: fix use-after-free bug of ns_writer on remount
- 7.8HighCVSS base score
- 0.22%Exploitation in 30 daysEPSS · top 87% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free bug of ns_writer on remount If a nilfs2 filesystem is downgraded to read-only due to metadata corruption on disk and is remounted read/write, or if emergency read-only remount is performed, detaching a log writer and synchronizing the filesystem can be done at the same time. In these cases, use-after-free of the log writer (hereinafter nilfs->ns_writer) can happen as shown in the scenario below: Task1 Task2 -------------------------------- ------------------------------ nilfs_construct_segment nilfs_segctor_sync init_wait init_waitqueue_entry add_wait_queue schedule nilfs_remount (R/W remount case) nilfs_attach_log_writer nilfs_detach_log_writer nilfs_segctor_destroy kfree finish_wait _raw_spin_lock_irqsave __raw_spin_lock_irqsave do_raw_spin_lock debug_spin_lock_before <-- use-after-free While Task1 is sleeping, nilfs->ns_writer is freed by Task2. After Task1 waked up, Task1 accesses nilfs->ns_writer which is already freed. This scenario diagram is based on the Shigeru Yoshida's post [1]. This patch fixes the issue by not detaching nilfs->ns_writer on remount so that this UAF race doesn't happen. Along with this change, this patch also inserts a few necessary read-only checks with superblock instance where only the ns_writer pointer was used to check if the filesystem is read-only.
Timeline
ID reserved
By Linux
Published
- 15 months later
· 15 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.22% · top 87% of all CVEs (15 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected fe5f171bb272946ce5fbf843ce2f8467d0d41b9a – < b2fbf10040216ef5ee270773755fc2f5da65b749
- affected fe5f171bb272946ce5fbf843ce2f8467d0d41b9a – < 39a3ed68270b079c6b874d4e4727a512b9b4882c
- affected fe5f171bb272946ce5fbf843ce2f8467d0d41b9a – < b4736ab5542112fe0a40f140a0a0b072954f34da
- affected fe5f171bb272946ce5fbf843ce2f8467d0d41b9a – < 9b162e81045266a2d5b44df9dffdf05c54de9cca
- affected fe5f171bb272946ce5fbf843ce2f8467d0d41b9a – < 4feedde5486c07ea79787839153a71ca71329c7d
- affected fe5f171bb272946ce5fbf843ce2f8467d0d41b9a – < afbd1188382a75f6cfe22c0b68533f7f9664f182
- affected fe5f171bb272946ce5fbf843ce2f8467d0d41b9a – < b152300d5a1ba4258dacf9916bff20e6a8c7603b
- affected fe5f171bb272946ce5fbf843ce2f8467d0d41b9a – < 8cccf05fe857a18ee26e20d11a8455a73ffd4efd
- affected 2.6.34
- unaffected < 2.6.34
- unaffected 4.9.334 – ≤ 4.9.*
- unaffected 4.14.300 – ≤ 4.14.*
- unaffected 4.19.267 – ≤ 4.19.*
- unaffected 5.4.225 – ≤ 5.4.*
- unaffected 5.10.155 – ≤ 5.10.*
- unaffected 5.15.79 – ≤ 5.15.*
- unaffected 6.0.9 – ≤ 6.0.*
- unaffected 6.1 – ≤ *
References
References8
- https://git.kernel.org/stable/c/b2fbf10040216ef5ee270773755fc2f5da65b749 (opens in a new tab)
- https://git.kernel.org/stable/c/39a3ed68270b079c6b874d4e4727a512b9b4882c (opens in a new tab)
- https://git.kernel.org/stable/c/b4736ab5542112fe0a40f140a0a0b072954f34da (opens in a new tab)
- https://git.kernel.org/stable/c/9b162e81045266a2d5b44df9dffdf05c54de9cca (opens in a new tab)
- https://git.kernel.org/stable/c/4feedde5486c07ea79787839153a71ca71329c7d (opens in a new tab)
- https://git.kernel.org/stable/c/afbd1188382a75f6cfe22c0b68533f7f9664f182 (opens in a new tab)
- https://git.kernel.org/stable/c/b152300d5a1ba4258dacf9916bff20e6a8c7603b (opens in a new tab)
- https://git.kernel.org/stable/c/8cccf05fe857a18ee26e20d11a8455a73ffd4efd (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-12938 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2022-49834)Record last updated .