{
  "cveId": "CVE-2022-50620",
  "url": "https://patchblox.com/security/cve/CVE-2022-50620",
  "summary": "CVE-2022-50620 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-50620, released December 8, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix to invalidate dcc-\u003Ef2fs_issue_discard...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix to invalidate dcc-\u003Ef2fs_issue_discard in error path  Syzbot reports a NULL pointer dereference issue as below:   __refcount_add include/linux/refcount.h:193 [inline]  __refcount_inc include/linux/refcount.h:250 [inline]  refcount_inc include/linux/refcount.h:267 [inline]  get_task_struct include/linux/sched/task.h:110 [inline]  kthread_stop\u002B0x34/0x1c0 kernel/kthread.c:703  f2fs_stop_discard_thread\u002B0x3c/0x5c fs/f2fs/segment.c:1638  kill_f2fs_super\u002B0x5c/0x194 fs/f2fs/super.c:4522  deactivate_locked_super\u002B0x70/0xe8 fs/super.c:332  deactivate_super\u002B0xd0/0xd4 fs/super.c:363  cleanup_mnt\u002B0x1f8/0x234 fs/namespace.c:1186  __cleanup_mnt\u002B0x20/0x30 fs/namespace.c:1193  task_work_run\u002B0xc4/0x14c kernel/task_work.c:177  exit_task_work include/linux/task_work.h:38 [inline]  do_exit\u002B0x26c/0xbe0 kernel/exit.c:795  do_group_exit\u002B0x60/0xe8 kernel/exit.c:925  __do_sys_exit_group kernel/exit.c:936 [inline]  __se_sys_exit_group kernel/exit.c:934 [inline]  __wake_up_parent\u002B0x0/0x40 kernel/exit.c:934  __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]  invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]  el0_svc_common\u002B0x138/0x220 arch/arm64/kernel/syscall.c:142  do_el0_svc\u002B0x48/0x164 arch/arm64/kernel/syscall.c:206  el0_svc\u002B0x58/0x150 arch/arm64/kernel/entry-common.c:636  el0t_64_sync_handler\u002B0x84/0xf0 arch/arm64/kernel/entry-common.c:654  el0t_64_sync\u002B0x18c/0x190 arch/arm64/kernel/entry.S:581  The root cause of this issue is in error path of f2fs_start_discard_thread(), it missed to invalidate dcc-\u003Ef2fs_issue_discard, later kthread_stop() may access invalid pointer.",
  "published": "2025-12-08T02:15:47Z",
  "severity": "",
  "epss": 0.00214,
  "epssPercentile": 0.11767,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.4-1",
      "fix": "DEBIAN-CVE-2022-50620",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50620",
      "released": "2025-12-08T02:15:47Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.1.4-1",
      "fix": "DEBIAN-CVE-2022-50620",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50620",
      "released": "2025-12-08T02:15:47Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.1.4-1",
      "fix": "DEBIAN-CVE-2022-50620",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50620",
      "released": "2025-12-08T02:15:47Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}