# CVE-2022-49352: linux: In the Linux kernel, the following vulnerability has been resolved:  ext4: fix warning in ext4_handle_inode_extension...

CVE-2022-49352 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49352, released February 26, 2025. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2022-49352
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0028
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Feb 26, 2025

## Description

In the Linux kernel, the following vulnerability has been resolved:  ext4: fix warning in ext4_handle_inode_extension  We got issue as follows: EXT4-fs error (device loop0) in ext4_reserve_inode_write:5741: Out of memory EXT4-fs error (device loop0): ext4_setattr:5462: inode #13: comm syz-executor.0: mark_inode_dirty error EXT4-fs error (device loop0) in ext4_setattr:5519: Out of memory EXT4-fs error (device loop0): ext4_ind_map_blocks:595: inode #13: comm syz-executor.0: Can't allocate blocks for non-extent mapped inodes with bigalloc ------------[ cut here ]------------ WARNING: CPU: 1 PID: 4361 at fs/ext4/file.c:301 ext4_file_write_iter+0x11c9/0x1220 Modules linked in: CPU: 1 PID: 4361 Comm: syz-executor.0 Not tainted 5.10.0+ #1 RIP: 0010:ext4_file_write_iter+0x11c9/0x1220 RSP: 0018:ffff924d80b27c00 EFLAGS: 00010282 RAX: ffffffff815a3379 RBX: 0000000000000000 RCX: 000000003b000000 RDX: ffff924d81601000 RSI: 00000000000009cc RDI: 00000000000009cd RBP: 000000000000000d R08: ffffffffbc5a2c6b R09: 0000902e0e52a96f R10: ffff902e2b7c1b40 R11: ffff902e2b7c1b40 R12: 000000000000000a R13: 0000000000000001 R14: ffff902e0e52aa10 R15: ffffffffffffff8b FS:  00007f81a7f65700(0000) GS:ffff902e3bc80000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffff600400 CR3: 000000012db88001 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace:  do_iter_readv_writev+0x2e5/0x360  do_iter_write+0x112/0x4c0  do_pwritev+0x1e5/0x390  __x64_sys_pwritev2+0x7e/0xa0  do_syscall_64+0x37/0x50  entry_SYSCALL_64_after_hwframe+0x44/0xa9  Above issue may happen as follows: Assume inode.i_size=4096 EXT4_I(inode)->i_disksize=4096  step 1: set inode->i_isize = 8192 ext4_setattr   if (attr->ia_size != inode->i_size)     EXT4_I(inode)->i_disksize = attr->ia_size;     rc = ext4_mark_inode_dirty        ext4_reserve_inode_write           ext4_get_inode_loc             __ext4_get_inode_loc               sb_getblk --> return -ENOMEM    ...    if (!error)  ->will not update i_size      i_size_write(inode, attr->ia_size); Now: inode.i_size=4096 EXT4_I(inode)->i_disksize=8192  step 2: Direct write 4096 bytes ext4_file_write_iter  ext4_dio_write_iter    iomap_dio_rw ->return error  if (extend)    ext4_handle_inode_extension      WARN_ON_ONCE(i_size_read(inode) < EXT4_I(inode)->i_disksize); ->Then trigger warning.  To solve above issue, if mark inode dirty failed in ext4_setattr just set 'EXT4_I(inode)->i_disksize' with old value.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 5.18.5-1 | [DEBIAN-CVE-2022-49352](https://patchblox.com/security/data/fix/linux/debian-cve-2022-49352.md) | Feb 26, 2025 |
| Linux | linux Debian 13.5 (trixie) | 5.18.5-1 | [DEBIAN-CVE-2022-49352](https://patchblox.com/security/data/fix/linux/debian-cve-2022-49352.md) | Feb 26, 2025 |
| Linux | linux Debian 14 | 5.18.5-1 | [DEBIAN-CVE-2022-49352](https://patchblox.com/security/data/fix/linux/debian-cve-2022-49352.md) | Feb 26, 2025 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.