CVE-2022-50620 (GCVE-0-2022-50620)

Vulnerability from cvelistv5 – Published: 2025-12-08 01:16 – Updated: 2026-05-11 19:22
VLAI
Title
f2fs: fix to invalidate dcc->f2fs_issue_discard in error path
Summary
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to invalidate dcc->f2fs_issue_discard in error path Syzbot reports a NULL pointer dereference issue as below: __refcount_add include/linux/refcount.h:193 [inline] __refcount_inc include/linux/refcount.h:250 [inline] refcount_inc include/linux/refcount.h:267 [inline] get_task_struct include/linux/sched/task.h:110 [inline] kthread_stop+0x34/0x1c0 kernel/kthread.c:703 f2fs_stop_discard_thread+0x3c/0x5c fs/f2fs/segment.c:1638 kill_f2fs_super+0x5c/0x194 fs/f2fs/super.c:4522 deactivate_locked_super+0x70/0xe8 fs/super.c:332 deactivate_super+0xd0/0xd4 fs/super.c:363 cleanup_mnt+0x1f8/0x234 fs/namespace.c:1186 __cleanup_mnt+0x20/0x30 fs/namespace.c:1193 task_work_run+0xc4/0x14c kernel/task_work.c:177 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0x26c/0xbe0 kernel/exit.c:795 do_group_exit+0x60/0xe8 kernel/exit.c:925 __do_sys_exit_group kernel/exit.c:936 [inline] __se_sys_exit_group kernel/exit.c:934 [inline] __wake_up_parent+0x0/0x40 kernel/exit.c:934 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall arch/arm64/kernel/syscall.c:52 [inline] el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:636 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581 The root cause of this issue is in error path of f2fs_start_discard_thread(), it missed to invalidate dcc->f2fs_issue_discard, later kthread_stop() may access invalid pointer.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4d67490498acb4ffcef5ba7bc44990d46e66a44c , < 865bb7b5a7deeb0e5afbd82381d52d38825dc64d (git)
Affected: 4d67490498acb4ffcef5ba7bc44990d46e66a44c , < a3e517a6ba695d683ee63615e1ea6e6b4c7d2732 (git)
Affected: 4d67490498acb4ffcef5ba7bc44990d46e66a44c , < ae6c960a82c52c3bda5adc82d90643d6c12d308e (git)
Affected: 4d67490498acb4ffcef5ba7bc44990d46e66a44c , < 91586ce0d39a05f88795aa8814fb99b1387236b3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.86 , ≤ 5.15.* (semver)
Unaffected: 6.0.16 , ≤ 6.0.* (semver)
Unaffected: 6.1.2 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/segment.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "865bb7b5a7deeb0e5afbd82381d52d38825dc64d",
              "status": "affected",
              "version": "4d67490498acb4ffcef5ba7bc44990d46e66a44c",
              "versionType": "git"
            },
            {
              "lessThan": "a3e517a6ba695d683ee63615e1ea6e6b4c7d2732",
              "status": "affected",
              "version": "4d67490498acb4ffcef5ba7bc44990d46e66a44c",
              "versionType": "git"
            },
            {
              "lessThan": "ae6c960a82c52c3bda5adc82d90643d6c12d308e",
              "status": "affected",
              "version": "4d67490498acb4ffcef5ba7bc44990d46e66a44c",
              "versionType": "git"
            },
            {
              "lessThan": "91586ce0d39a05f88795aa8814fb99b1387236b3",
              "status": "affected",
              "version": "4d67490498acb4ffcef5ba7bc44990d46e66a44c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/segment.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.86",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.16",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to invalidate dcc-\u003ef2fs_issue_discard in error path\n\nSyzbot reports a NULL pointer dereference issue as below:\n\n __refcount_add include/linux/refcount.h:193 [inline]\n __refcount_inc include/linux/refcount.h:250 [inline]\n refcount_inc include/linux/refcount.h:267 [inline]\n get_task_struct include/linux/sched/task.h:110 [inline]\n kthread_stop+0x34/0x1c0 kernel/kthread.c:703\n f2fs_stop_discard_thread+0x3c/0x5c fs/f2fs/segment.c:1638\n kill_f2fs_super+0x5c/0x194 fs/f2fs/super.c:4522\n deactivate_locked_super+0x70/0xe8 fs/super.c:332\n deactivate_super+0xd0/0xd4 fs/super.c:363\n cleanup_mnt+0x1f8/0x234 fs/namespace.c:1186\n __cleanup_mnt+0x20/0x30 fs/namespace.c:1193\n task_work_run+0xc4/0x14c kernel/task_work.c:177\n exit_task_work include/linux/task_work.h:38 [inline]\n do_exit+0x26c/0xbe0 kernel/exit.c:795\n do_group_exit+0x60/0xe8 kernel/exit.c:925\n __do_sys_exit_group kernel/exit.c:936 [inline]\n __se_sys_exit_group kernel/exit.c:934 [inline]\n __wake_up_parent+0x0/0x40 kernel/exit.c:934\n __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]\n invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]\n el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142\n do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206\n el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:636\n el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654\n el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581\n\nThe root cause of this issue is in error path of f2fs_start_discard_thread(),\nit missed to invalidate dcc-\u003ef2fs_issue_discard, later kthread_stop() may\naccess invalid pointer."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:22:22.059Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/865bb7b5a7deeb0e5afbd82381d52d38825dc64d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3e517a6ba695d683ee63615e1ea6e6b4c7d2732"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae6c960a82c52c3bda5adc82d90643d6c12d308e"
        },
        {
          "url": "https://git.kernel.org/stable/c/91586ce0d39a05f88795aa8814fb99b1387236b3"
        }
      ],
      "title": "f2fs: fix to invalidate dcc-\u003ef2fs_issue_discard in error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50620",
    "datePublished": "2025-12-08T01:16:33.771Z",
    "dateReserved": "2025-12-08T01:14:55.189Z",
    "dateUpdated": "2026-05-11T19:22:22.059Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50620",
      "date": "2026-09-28",
      "epss": "0.00199",
      "percentile": "0.08742"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/f2fs/segment.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "865bb7b5a7deeb0e5afbd82381d52d38825dc64d",
                    "status": "affected",
                    "version": "4d67490498acb4ffcef5ba7bc44990d46e66a44c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a3e517a6ba695d683ee63615e1ea6e6b4c7d2732",
                    "status": "affected",
                    "version": "4d67490498acb4ffcef5ba7bc44990d46e66a44c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ae6c960a82c52c3bda5adc82d90643d6c12d308e",
                    "status": "affected",
                    "version": "4d67490498acb4ffcef5ba7bc44990d46e66a44c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "91586ce0d39a05f88795aa8814fb99b1387236b3",
                    "status": "affected",
                    "version": "4d67490498acb4ffcef5ba7bc44990d46e66a44c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/f2fs/segment.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.86",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.0.*",
                    "status": "unaffected",
                    "version": "6.0.16",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to invalidate dcc-\u003ef2fs_issue_discard in error path\n\nSyzbot reports a NULL pointer dereference issue as below:\n\n __refcount_add include/linux/refcount.h:193 [inline]\n __refcount_inc include/linux/refcount.h:250 [inline]\n refcount_inc include/linux/refcount.h:267 [inline]\n get_task_struct include/linux/sched/task.h:110 [inline]\n kthread_stop+0x34/0x1c0 kernel/kthread.c:703\n f2fs_stop_discard_thread+0x3c/0x5c fs/f2fs/segment.c:1638\n kill_f2fs_super+0x5c/0x194 fs/f2fs/super.c:4522\n deactivate_locked_super+0x70/0xe8 fs/super.c:332\n deactivate_super+0xd0/0xd4 fs/super.c:363\n cleanup_mnt+0x1f8/0x234 fs/namespace.c:1186\n __cleanup_mnt+0x20/0x30 fs/namespace.c:1193\n task_work_run+0xc4/0x14c kernel/task_work.c:177\n exit_task_work include/linux/task_work.h:38 [inline]\n do_exit+0x26c/0xbe0 kernel/exit.c:795\n do_group_exit+0x60/0xe8 kernel/exit.c:925\n __do_sys_exit_group kernel/exit.c:936 [inline]\n __se_sys_exit_group kernel/exit.c:934 [inline]\n __wake_up_parent+0x0/0x40 kernel/exit.c:934\n __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]\n invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]\n el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142\n do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206\n el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:636\n el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654\n el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581\n\nThe root cause of this issue is in error path of f2fs_start_discard_thread(),\nit missed to invalidate dcc-\u003ef2fs_issue_discard, later kthread_stop() may\naccess invalid pointer."
          }
        ],
        "id": "CVE-2022-50620",
        "lastModified": "2026-06-17T05:23:52.840",
        "metrics": {},
        "published": "2025-12-08T02:15:47.870",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/865bb7b5a7deeb0e5afbd82381d52d38825dc64d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/91586ce0d39a05f88795aa8814fb99b1387236b3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a3e517a6ba695d683ee63615e1ea6e6b4c7d2732"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ae6c960a82c52c3bda5adc82d90643d6c12d308e"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:19:35+00:00",
      "cve": "CVE-2022-50620",
      "id": "CVE-2022-50620",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: f2fs: fix to invalidate dcc-\u003ef2fs_issue_discard in error path",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50620.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T01:22:10Z",
      "cve": "CVE-2022-50620",
      "id": "CVE-2022-50620",
      "initial_release_date": "2025-12-09T00:31:32Z",
      "product_status:known_not_affected": "515",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50620",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50620.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.