{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2022-50270 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2022-50270 is a high-severity vulnerability in Linux kernel, published on 15 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-50270 and fix it if it is affected.\n\nWhat it is: CVE-2022-50270 is a high-severity vulnerability in Linux kernel, published on 15 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2022-50270 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-50270/ (Markdown: https://insights.sbomify.com/CVE-2022-50270/index.md)","id":"CVE-2022-50270","markdown":"https://insights.sbomify.com/CVE-2022-50270/index.md","name":"CVE-2022-50270","record":{"aliases":["DEBIAN-CVE-2022-50270","GHSA-r3c5-gg5h-vgc4","UBUNTU-CVE-2022-50270"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A null pointer dereference in the Linux kernel f2fs tracepoint can cause a system crash when reading trace data.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":7.1,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix the assign logic of iocb\n\ncommit 18ae8d12991b (\"f2fs: show more DIO information in tracepoint\")\nintroduces iocb field in 'f2fs_direct_IO_enter' trace event\nAnd it only assigns the pointer and later it accesses its field\nin trace print log.\n\nUnable to handle kernel paging request at virtual address ffffffc04cef3d30\nMem abort info:\nESR = 0x96000007\nEC = 0x25: DABT (current EL), IL = 32 bits\n\n pc : trace_raw_output_f2fs_direct_IO_enter+0x54/0xa4\n lr : trace_raw_output_f2fs_direct_IO_enter+0x2c/0xa4\n sp : ffffffc0443cbbd0\n x29: ffffffc0443cbbf0 x28: ffffff8935b120d0 x27: ffffff8935b12108\n x26: ffffff8935b120f0 x25: ffffff8935b12100 x24: ffffff8935b110c0\n x23: ffffff8935b10000 x22: ffffff88859a936c x21: ffffff88859a936c\n x20: ffffff8935b110c0 x19: ffffff8935b10000 x18: ffffffc03b195060\n x17: ffffff8935b11e76 x16: 00000000000000cc x15: ffffffef855c4f2c\n x14: 0000000000000001 x13: 000000000000004e x12: ffff0000ffffff00\n x11: ffffffef86c350d0 x10: 00000000000010c0 x9 : 000000000fe0002c\n x8 : ffffffc04cef3d28 x7 : 7f7f7f7f7f7f7f7f x6 : 0000000002000000\n x5 : ffffff8935b11e9a x4 : 0000000000006250 x3 : ffff0a00ffffff04\n x2 : 0000000000000002 x1 : ffffffef86a0a31f x0 : ffffff8935b10000\n Call trace:\n  trace_raw_output_f2fs_direct_IO_enter+0x54/0xa4\n  print_trace_fmt+0x9c/0x138\n  print_trace_line+0x154/0x254\n  tracing_read_pipe+0x21c/0x380\n  vfs_read+0x108/0x3ac\n  ksys_read+0x7c/0xec\n  __arm64_sys_read+0x20/0x30\n  invoke_syscall+0x60/0x150\n  el0_svc_common.llvm.1237943816091755067+0xb8/0xf8\n  do_el0_svc+0x28/0xa0\n\nFix it by copying the required variables for printing and while at\nit fix the similar issue at some other places in the same file.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"f2fs: fix the assign logic of iocb","id":"CVE-2022-50270","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"null_dereference","year":"2022"},"n_packages":0,"n_references":3,"next":{"headline":"vhost/vsock: Use kvmalloc/kvfree for larger packets.","id":"CVE-2022-50271"},"packages":[],"prev":{"headline":"drm/vkms: Fix memory leak in vkms_init()","id":"CVE-2022-50269"},"products":["Linux"],"published":"2025-09-15","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-08-05","vendors":["Linux"]},"summary":"A null pointer dereference in the Linux kernel f2fs tracepoint can cause a system crash when reading trace data.","url":"https://insights.sbomify.com/CVE-2022-50270/"}