CVE-2022-50013 f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page()

Medium 5.5 Published 18 Jun 2025 Updated 15 Aug 2026

A local attacker can trigger a kernel panic in the f2fs filesystem by exploiting inconsistent NAT entry and bitmap states, causing a denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2022-50013?

CVE-2022-50013 is a medium-severity denial of service vulnerability in Linux kernel, published on 18 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page()

As Dipanjan Das <[email protected]> reported, syzkaller found a f2fs bug as below:

RIP: 0010:f2fs_new_node_page+0x19ac/0x1fc0 fs/f2fs/node.c:1295 Call Trace: write_all_xattrs fs/f2fs/xattr.c:487 [inline] __f2fs_setxattr+0xe76/0x2e10 fs/f2fs/xattr.c:743 f2fs_setxattr+0x233/0xab0 fs/f2fs/xattr.c:790 f2fs_xattr_generic_set+0x133/0x170 fs/f2fs/xattr.c:86 __vfs_setxattr+0x115/0x180 fs/xattr.c:182 __vfs_setxattr_noperm+0x125/0x5f0 fs/xattr.c:216 __vfs_setxattr_locked+0x1cf/0x260 fs/xattr.c:277 vfs_setxattr+0x13f/0x330 fs/xattr.c:303 setxattr+0x146/0x160 fs/xattr.c:611 path_setxattr+0x1a7/0x1d0 fs/xattr.c:630 __do_sys_lsetxattr fs/xattr.c:653 [inline] __se_sys_lsetxattr fs/xattr.c:649 [inline] __x64_sys_lsetxattr+0xbd/0x150 fs/xattr.c:649 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0

NAT entry and nat bitmap can be inconsistent, e.g. one nid is free in nat bitmap, and blkaddr in its NAT entry is not NULL_ADDR, it may trigger BUG_ON() in f2fs_new_node_page(), fix it.

Which versions are affected by CVE-2022-50013?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2022-50013?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-50013 being exploited?

There is no known exploitation of CVE-2022-50013 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as DEBIAN-CVE-2022-50013, GHSA-v373-5hg6-925q, UBUNTU-CVE-2022-50013.