CVE-2022-49274 ocfs2: fix crash when mount with quota enabled
A local attacker can cause a system crash by mounting an OCFS2 filesystem with quotas enabled due to uninitialized variables.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-49274?
CVE-2022-49274 is a high-severity vulnerability in Linux kernel, published on 26 Feb 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix crash when mount with quota enabled
There is a reported crash when mounting ocfs2 with quota enabled.
RIP: 0010:ocfs2_qinfo_lock_res_init+0x44/0x50 [ocfs2] Call Trace: ocfs2_local_read_info+0xb9/0x6f0 [ocfs2] dquot_load_quota_sb+0x216/0x470 dquot_load_quota_inode+0x85/0x100 ocfs2_enable_quotas+0xa0/0x1c0 [ocfs2] ocfs2_fill_super.cold+0xc8/0x1bf [ocfs2] mount_bdev+0x185/0x1b0 legacy_get_tree+0x27/0x40 vfs_get_tree+0x25/0xb0 path_mount+0x465/0xac0 __x64_sys_mount+0x103/0x140
It is caused by when initializing dqi_gqlock, the corresponding dqi_type and dqi_sb are not properly initialized.
This issue is introduced by commit 6c85c2c72819, which wants to avoid accessing uninitialized variables in error cases. So make global quota info properly initialized.
Weakness: CWE-908
Which versions are affected by CVE-2022-49274?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-49274?
Apply the vendor's patch.
Is CVE-2022-49274 being exploited?
There is no known exploitation of CVE-2022-49274 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-49274, GHSA-r9cg-795w-r2qr, UBUNTU-CVE-2022-49274.