# CVE-2022-49360: linux: In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix to do sanity check on total_data_block...

CVE-2022-49360 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49360, released February 26, 2025. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2022-49360
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0026
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Feb 26, 2025

## Description

In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix to do sanity check on total_data_blocks  As Yanming reported in bugzilla:  https://bugzilla.kernel.org/show_bug.cgi?id=215916  The kernel message is shown below:  kernel BUG at fs/f2fs/segment.c:2560! Call Trace:  allocate_segment_by_default+0x228/0x440  f2fs_allocate_data_block+0x13d1/0x31f0  do_write_page+0x18d/0x710  f2fs_outplace_write_data+0x151/0x250  f2fs_do_write_data_page+0xef9/0x1980  move_data_page+0x6af/0xbc0  do_garbage_collect+0x312f/0x46f0  f2fs_gc+0x6b0/0x3bc0  f2fs_balance_fs+0x921/0x2260  f2fs_write_single_data_page+0x16be/0x2370  f2fs_write_cache_pages+0x428/0xd00  f2fs_write_data_pages+0x96e/0xd50  do_writepages+0x168/0x550  __writeback_single_inode+0x9f/0x870  writeback_sb_inodes+0x47d/0xb20  __writeback_inodes_wb+0xb2/0x200  wb_writeback+0x4bd/0x660  wb_workfn+0x5f3/0xab0  process_one_work+0x79f/0x13e0  worker_thread+0x89/0xf60  kthread+0x26a/0x300  ret_from_fork+0x22/0x30 RIP: 0010:new_curseg+0xe8d/0x15f0  The root cause is: ckpt.valid_block_count is inconsistent with SIT table, stat info indicates filesystem has free blocks, but SIT table indicates filesystem has no free segment.  So that during garbage colloection, it triggers panic when LFS allocator fails to find free segment.  This patch tries to fix this issue by checking consistency in between ckpt.valid_block_count and block accounted from SIT.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 5.18.5-1 | [DEBIAN-CVE-2022-49360](https://patchblox.com/security/data/fix/linux/debian-cve-2022-49360.md) | Feb 26, 2025 |
| Linux | linux Debian 13.5 (trixie) | 5.18.5-1 | [DEBIAN-CVE-2022-49360](https://patchblox.com/security/data/fix/linux/debian-cve-2022-49360.md) | Feb 26, 2025 |
| Linux | linux Debian 14 | 5.18.5-1 | [DEBIAN-CVE-2022-49360](https://patchblox.com/security/data/fix/linux/debian-cve-2022-49360.md) | Feb 26, 2025 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.