{
  "cveId": "CVE-2022-50009",
  "url": "https://patchblox.com/security/cve/CVE-2022-50009",
  "summary": "CVE-2022-50009 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-50009, released June 18, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "f2fs: fix null-ptr-deref in f2fs_get_dnode_of_data",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix null-ptr-deref in f2fs_get_dnode_of_data  There is issue as follows when test f2fs atomic write: F2FS-fs (loop0): Can\u0027t find valid F2FS filesystem in 2th superblock F2FS-fs (loop0): invalid crc_offset: 0 F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=1, run fsck to fix. F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=2, run fsck to fix. ================================================================== BUG: KASAN: null-ptr-deref in f2fs_get_dnode_of_data\u002B0xac/0x16d0 Read of size 8 at addr 0000000000000028 by task rep/1990  CPU: 4 PID: 1990 Comm: rep Not tainted 5.19.0-rc6-next-20220715 #266 Call Trace:  \u003CTASK\u003E  dump_stack_lvl\u002B0x6e/0x91  print_report.cold\u002B0x49a/0x6bb  kasan_report\u002B0xa8/0x130  f2fs_get_dnode_of_data\u002B0xac/0x16d0  f2fs_do_write_data_page\u002B0x2a5/0x1030  move_data_page\u002B0x3c5/0xdf0  do_garbage_collect\u002B0x2015/0x36c0  f2fs_gc\u002B0x554/0x1d30  f2fs_balance_fs\u002B0x7f5/0xda0  f2fs_write_single_data_page\u002B0xb66/0xdc0  f2fs_write_cache_pages\u002B0x716/0x1420  f2fs_write_data_pages\u002B0x84f/0x9a0  do_writepages\u002B0x130/0x3a0  filemap_fdatawrite_wbc\u002B0x87/0xa0  file_write_and_wait_range\u002B0x157/0x1c0  f2fs_do_sync_file\u002B0x206/0x12d0  f2fs_sync_file\u002B0x99/0xc0  vfs_fsync_range\u002B0x75/0x140  f2fs_file_write_iter\u002B0xd7b/0x1850  vfs_write\u002B0x645/0x780  ksys_write\u002B0xf1/0x1e0  do_syscall_64\u002B0x3b/0x90  entry_SYSCALL_64_after_hwframe\u002B0x63/0xcd  As 3db1de0e582c commit changed atomic write way which new a cow_inode for atomic write file, and also mark cow_inode as FI_ATOMIC_FILE. When f2fs_do_write_data_page write cow_inode will use cow_inode\u0027s cow_inode which is NULL. Then will trigger null-ptr-deref. To solve above issue, introduce FI_COW_FILE flag for COW inode.  Fiexes: 3db1de0e582c(\u0022f2fs: change the current atomic write way\u0022)",
  "published": "2025-06-18T11:15:28Z",
  "severity": "Moderate",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "cwe": "NULL Pointer Dereference",
  "epss": 0.00193,
  "epssPercentile": 0.08983,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-50009",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.19.6-1",
      "fix": "DEBIAN-CVE-2022-50009",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50009",
      "released": "2025-06-18T11:15:28Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.19.6-1",
      "fix": "DEBIAN-CVE-2022-50009",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50009",
      "released": "2025-06-18T11:15:28Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.19.6-1",
      "fix": "DEBIAN-CVE-2022-50009",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50009",
      "released": "2025-06-18T11:15:28Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}