GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50755 (GCVE-0-2022-50755)

Vulnerability from cvelistv5 – Published: 2025-12-24 13:05 – Updated: 2026-08-05 08:59
VLAI
Title
udf: Avoid double brelse() in udf_rename()
Summary
In the Linux kernel, the following vulnerability has been resolved: udf: Avoid double brelse() in udf_rename() syzbot reported a warning like below [1]: VFS: brelse: Trying to free free buffer WARNING: CPU: 2 PID: 7301 at fs/buffer.c:1145 __brelse+0x67/0xa0 ... Call Trace: <TASK> invalidate_bh_lru+0x99/0x150 smp_call_function_many_cond+0xe2a/0x10c0 ? generic_remap_file_range_prep+0x50/0x50 ? __brelse+0xa0/0xa0 ? __mutex_lock+0x21c/0x12d0 ? smp_call_on_cpu+0x250/0x250 ? rcu_read_lock_sched_held+0xb/0x60 ? lock_release+0x587/0x810 ? __brelse+0xa0/0xa0 ? generic_remap_file_range_prep+0x50/0x50 on_each_cpu_cond_mask+0x3c/0x80 blkdev_flush_mapping+0x13a/0x2f0 blkdev_put_whole+0xd3/0xf0 blkdev_put+0x222/0x760 deactivate_locked_super+0x96/0x160 deactivate_super+0xda/0x100 cleanup_mnt+0x222/0x3d0 task_work_run+0x149/0x240 ? task_work_cancel+0x30/0x30 do_exit+0xb29/0x2a40 ? reacquire_held_locks+0x4a0/0x4a0 ? do_raw_spin_lock+0x12a/0x2b0 ? mm_update_next_owner+0x7c0/0x7c0 ? rwlock_bug.part.0+0x90/0x90 ? zap_other_threads+0x234/0x2d0 do_group_exit+0xd0/0x2a0 __x64_sys_exit_group+0x3a/0x50 do_syscall_64+0x34/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd The cause of the issue is that brelse() is called on both ofibh.sbh and ofibh.ebh by udf_find_entry() when it returns NULL. However, brelse() is called by udf_rename(), too. So, b_count on buffer_head becomes unbalanced. This patch fixes the issue by not calling brelse() by udf_rename() when udf_find_entry() returns NULL.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 231473f6ddcef9c01993e0bfe36acc6f8e425c31 , < 78eba2778ae10fb2a9d450e14d26eb6f6bf1f906 (git)
Affected: 231473f6ddcef9c01993e0bfe36acc6f8e425c31 , < 9d2cad69547abea961fa80426d600b861de1952b (git)
Affected: 231473f6ddcef9c01993e0bfe36acc6f8e425c31 , < d6da7ec0f94f5208c848e0e94b70f54a0bd9c587 (git)
Affected: 231473f6ddcef9c01993e0bfe36acc6f8e425c31 , < 156d440dea97deada629bb51cb17887abd862605 (git)
Affected: 231473f6ddcef9c01993e0bfe36acc6f8e425c31 , < 40dba68d418237b1ae2beaa06d46a94dd946278e (git)
Affected: 231473f6ddcef9c01993e0bfe36acc6f8e425c31 , < e7a6a53c871460727be09f4414ccb29fb8697526 (git)
Affected: 231473f6ddcef9c01993e0bfe36acc6f8e425c31 , < 4fca09045509f5bde8fc28e68fbca38cb4bdcf2e (git)
Affected: 231473f6ddcef9c01993e0bfe36acc6f8e425c31 , < 090bf49833c51da297ec74f98ad2bf44daea9311 (git)
Affected: 231473f6ddcef9c01993e0bfe36acc6f8e425c31 , < c791730f2554a9ebb8f18df9368dc27d4ebc38c2 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.2
Unaffected: 0 , < 4.2 (semver)
Unaffected: 4.9.337 , ≤ 4.9.* (semver)
Unaffected: 4.14.303 , ≤ 4.14.* (semver)
Unaffected: 4.19.270 , ≤ 4.19.* (semver)
Unaffected: 5.4.229 , ≤ 5.4.* (semver)
Unaffected: 5.10.163 , ≤ 5.10.* (semver)
Unaffected: 5.15.86 , ≤ 5.15.* (semver)
Unaffected: 6.0.16 , ≤ 6.0.* (semver)
Unaffected: 6.1.2 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/udf/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "78eba2778ae10fb2a9d450e14d26eb6f6bf1f906",
              "status": "affected",
              "version": "231473f6ddcef9c01993e0bfe36acc6f8e425c31",
              "versionType": "git"
            },
            {
              "lessThan": "9d2cad69547abea961fa80426d600b861de1952b",
              "status": "affected",
              "version": "231473f6ddcef9c01993e0bfe36acc6f8e425c31",
              "versionType": "git"
            },
            {
              "lessThan": "d6da7ec0f94f5208c848e0e94b70f54a0bd9c587",
              "status": "affected",
              "version": "231473f6ddcef9c01993e0bfe36acc6f8e425c31",
              "versionType": "git"
            },
            {
              "lessThan": "156d440dea97deada629bb51cb17887abd862605",
              "status": "affected",
              "version": "231473f6ddcef9c01993e0bfe36acc6f8e425c31",
              "versionType": "git"
            },
            {
              "lessThan": "40dba68d418237b1ae2beaa06d46a94dd946278e",
              "status": "affected",
              "version": "231473f6ddcef9c01993e0bfe36acc6f8e425c31",
              "versionType": "git"
            },
            {
              "lessThan": "e7a6a53c871460727be09f4414ccb29fb8697526",
              "status": "affected",
              "version": "231473f6ddcef9c01993e0bfe36acc6f8e425c31",
              "versionType": "git"
            },
            {
              "lessThan": "4fca09045509f5bde8fc28e68fbca38cb4bdcf2e",
              "status": "affected",
              "version": "231473f6ddcef9c01993e0bfe36acc6f8e425c31",
              "versionType": "git"
            },
            {
              "lessThan": "090bf49833c51da297ec74f98ad2bf44daea9311",
              "status": "affected",
              "version": "231473f6ddcef9c01993e0bfe36acc6f8e425c31",
              "versionType": "git"
            },
            {
              "lessThan": "c791730f2554a9ebb8f18df9368dc27d4ebc38c2",
              "status": "affected",
              "version": "231473f6ddcef9c01993e0bfe36acc6f8e425c31",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/udf/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.337",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.303",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.229",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.337",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.303",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.270",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.229",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.163",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.86",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.16",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.2",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Avoid double brelse() in udf_rename()\n\nsyzbot reported a warning like below [1]:\n\nVFS: brelse: Trying to free free buffer\nWARNING: CPU: 2 PID: 7301 at fs/buffer.c:1145 __brelse+0x67/0xa0\n...\nCall Trace:\n \u003cTASK\u003e\n invalidate_bh_lru+0x99/0x150\n smp_call_function_many_cond+0xe2a/0x10c0\n ? generic_remap_file_range_prep+0x50/0x50\n ? __brelse+0xa0/0xa0\n ? __mutex_lock+0x21c/0x12d0\n ? smp_call_on_cpu+0x250/0x250\n ? rcu_read_lock_sched_held+0xb/0x60\n ? lock_release+0x587/0x810\n ? __brelse+0xa0/0xa0\n ? generic_remap_file_range_prep+0x50/0x50\n on_each_cpu_cond_mask+0x3c/0x80\n blkdev_flush_mapping+0x13a/0x2f0\n blkdev_put_whole+0xd3/0xf0\n blkdev_put+0x222/0x760\n deactivate_locked_super+0x96/0x160\n deactivate_super+0xda/0x100\n cleanup_mnt+0x222/0x3d0\n task_work_run+0x149/0x240\n ? task_work_cancel+0x30/0x30\n do_exit+0xb29/0x2a40\n ? reacquire_held_locks+0x4a0/0x4a0\n ? do_raw_spin_lock+0x12a/0x2b0\n ? mm_update_next_owner+0x7c0/0x7c0\n ? rwlock_bug.part.0+0x90/0x90\n ? zap_other_threads+0x234/0x2d0\n do_group_exit+0xd0/0x2a0\n __x64_sys_exit_group+0x3a/0x50\n do_syscall_64+0x34/0xb0\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nThe cause of the issue is that brelse() is called on both ofibh.sbh\nand ofibh.ebh by udf_find_entry() when it returns NULL.  However,\nbrelse() is called by udf_rename(), too.  So, b_count on buffer_head\nbecomes unbalanced.\n\nThis patch fixes the issue by not calling brelse() by udf_rename()\nwhen udf_find_entry() returns NULL."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local rename(2)/renameat2 on a mounted UDF filesystem (vfs_rename \u2192 udf_rename \u2192 udf_find_entry); no network or adjacent protocol handler reaches this path.\nAC:L - A crafted UDF image that makes udf_find_entry() return NULL during rename (as in the syzbot C repro with controlled charset/options) deterministically double-brelse()s the directory buffer_heads with no race or attacker-uncontrollable condition.\nPR:L - UDF lacks FS_USERNS_MOUNT so raw mount needs CAP_SYS_ADMIN, but default UDisks/polkit policy lets an active unprivileged user mount removable UDF media and then rename on that volume, matching CVE-2026-64324.\nUI:N - The attacking local user can mount their own crafted UDF image via UDisks and issue rename themselves; no separate victim action is required.\nS:U - The buffer_head refcount underflow and resulting corruption stay inside the host kernel VFS/UDF authority; this is ordinary same-host kernel impact, not a VM/IOMMU/sandbox boundary cross.\nC:H - Double brelse() underflows a still-cached directory buffer_head reference, yielding a bh_cachep use-after-free whose recycled object contents (b_data, b_page, b_end_io) can be disclosed, consistent with CVE-2024-49882 double-brelse scoring.\nI:H - The same buffer_head UAF exposes b_end_io and list pointers for heap-spray write and control-flow hijack primitives, and can corrupt adjacent page-cache metadata buffers.\nA:H - The unbalanced b_count reproducibly hits WARN in __brelse() (fatal under panic_on_warn) and the resulting use-after-free can oops/panic the kernel during later invalidate/unmount, fully denying availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:59:41.275Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/78eba2778ae10fb2a9d450e14d26eb6f6bf1f906"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d2cad69547abea961fa80426d600b861de1952b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d6da7ec0f94f5208c848e0e94b70f54a0bd9c587"
        },
        {
          "url": "https://git.kernel.org/stable/c/156d440dea97deada629bb51cb17887abd862605"
        },
        {
          "url": "https://git.kernel.org/stable/c/40dba68d418237b1ae2beaa06d46a94dd946278e"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7a6a53c871460727be09f4414ccb29fb8697526"
        },
        {
          "url": "https://git.kernel.org/stable/c/4fca09045509f5bde8fc28e68fbca38cb4bdcf2e"
        },
        {
          "url": "https://git.kernel.org/stable/c/090bf49833c51da297ec74f98ad2bf44daea9311"
        },
        {
          "url": "https://git.kernel.org/stable/c/c791730f2554a9ebb8f18df9368dc27d4ebc38c2"
        }
      ],
      "title": "udf: Avoid double brelse() in udf_rename()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50755",
    "datePublished": "2025-12-24T13:05:48.928Z",
    "dateReserved": "2025-12-24T13:02:21.544Z",
    "dateUpdated": "2026-08-05T08:59:41.275Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50755",
      "date": "2026-09-18",
      "epss": "0.00204",
      "percentile": "0.10782"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/udf/namei.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "78eba2778ae10fb2a9d450e14d26eb6f6bf1f906",
                    "status": "affected",
                    "version": "231473f6ddcef9c01993e0bfe36acc6f8e425c31",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9d2cad69547abea961fa80426d600b861de1952b",
                    "status": "affected",
                    "version": "231473f6ddcef9c01993e0bfe36acc6f8e425c31",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d6da7ec0f94f5208c848e0e94b70f54a0bd9c587",
                    "status": "affected",
                    "version": "231473f6ddcef9c01993e0bfe36acc6f8e425c31",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "156d440dea97deada629bb51cb17887abd862605",
                    "status": "affected",
                    "version": "231473f6ddcef9c01993e0bfe36acc6f8e425c31",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "40dba68d418237b1ae2beaa06d46a94dd946278e",
                    "status": "affected",
                    "version": "231473f6ddcef9c01993e0bfe36acc6f8e425c31",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e7a6a53c871460727be09f4414ccb29fb8697526",
                    "status": "affected",
                    "version": "231473f6ddcef9c01993e0bfe36acc6f8e425c31",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4fca09045509f5bde8fc28e68fbca38cb4bdcf2e",
                    "status": "affected",
                    "version": "231473f6ddcef9c01993e0bfe36acc6f8e425c31",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "090bf49833c51da297ec74f98ad2bf44daea9311",
                    "status": "affected",
                    "version": "231473f6ddcef9c01993e0bfe36acc6f8e425c31",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c791730f2554a9ebb8f18df9368dc27d4ebc38c2",
                    "status": "affected",
                    "version": "231473f6ddcef9c01993e0bfe36acc6f8e425c31",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/udf/namei.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.2"
                  },
                  {
                    "lessThan": "4.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.9.*",
                    "status": "unaffected",
                    "version": "4.9.337",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.14.*",
                    "status": "unaffected",
                    "version": "4.14.303",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.229",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.163",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.86",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.0.*",
                    "status": "unaffected",
                    "version": "6.0.16",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Avoid double brelse() in udf_rename()\n\nsyzbot reported a warning like below [1]:\n\nVFS: brelse: Trying to free free buffer\nWARNING: CPU: 2 PID: 7301 at fs/buffer.c:1145 __brelse+0x67/0xa0\n...\nCall Trace:\n \u003cTASK\u003e\n invalidate_bh_lru+0x99/0x150\n smp_call_function_many_cond+0xe2a/0x10c0\n ? generic_remap_file_range_prep+0x50/0x50\n ? __brelse+0xa0/0xa0\n ? __mutex_lock+0x21c/0x12d0\n ? smp_call_on_cpu+0x250/0x250\n ? rcu_read_lock_sched_held+0xb/0x60\n ? lock_release+0x587/0x810\n ? __brelse+0xa0/0xa0\n ? generic_remap_file_range_prep+0x50/0x50\n on_each_cpu_cond_mask+0x3c/0x80\n blkdev_flush_mapping+0x13a/0x2f0\n blkdev_put_whole+0xd3/0xf0\n blkdev_put+0x222/0x760\n deactivate_locked_super+0x96/0x160\n deactivate_super+0xda/0x100\n cleanup_mnt+0x222/0x3d0\n task_work_run+0x149/0x240\n ? task_work_cancel+0x30/0x30\n do_exit+0xb29/0x2a40\n ? reacquire_held_locks+0x4a0/0x4a0\n ? do_raw_spin_lock+0x12a/0x2b0\n ? mm_update_next_owner+0x7c0/0x7c0\n ? rwlock_bug.part.0+0x90/0x90\n ? zap_other_threads+0x234/0x2d0\n do_group_exit+0xd0/0x2a0\n __x64_sys_exit_group+0x3a/0x50\n do_syscall_64+0x34/0xb0\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nThe cause of the issue is that brelse() is called on both ofibh.sbh\nand ofibh.ebh by udf_find_entry() when it returns NULL.  However,\nbrelse() is called by udf_rename(), too.  So, b_count on buffer_head\nbecomes unbalanced.\n\nThis patch fixes the issue by not calling brelse() by udf_rename()\nwhen udf_find_entry() returns NULL."
          }
        ],
        "id": "CVE-2022-50755",
        "lastModified": "2026-08-04T10:18:23.497",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-24T13:16:02.250",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/090bf49833c51da297ec74f98ad2bf44daea9311"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/156d440dea97deada629bb51cb17887abd862605"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/40dba68d418237b1ae2beaa06d46a94dd946278e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4fca09045509f5bde8fc28e68fbca38cb4bdcf2e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/78eba2778ae10fb2a9d450e14d26eb6f6bf1f906"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9d2cad69547abea961fa80426d600b861de1952b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c791730f2554a9ebb8f18df9368dc27d4ebc38c2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d6da7ec0f94f5208c848e0e94b70f54a0bd9c587"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e7a6a53c871460727be09f4414ccb29fb8697526"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:58:24+00:00",
      "cve": "CVE-2022-50755",
      "id": "CVE-2022-50755",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel UDF filesystem: Denial of Service due to memory corruption during rename operations",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50755.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T16:50:05Z",
      "cve": "CVE-2022-50755",
      "id": "CVE-2022-50755",
      "initial_release_date": "2025-12-25T01:04:06Z",
      "product_status:known_affected": "548",
      "product_status:known_not_affected": "178",
      "product_status:recommended": "233",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50755",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50755.json",
      "version": "28"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.