CVE-2022-49174

A flaw was found in the Linux kernel’s EXT4 filesystem implementation (ext4_mb_mark_bb()), affecting configurations with the flex_bg feature (enabled by default) and fast_commit. When processing extents that span across block group boundaries, the function reads the block bitmap buffer only once and fails to update it for subsequent groups. This results in out-of-bounds memory access and a data abort, leading to kernel crashes when mounting or operating on affected filesystems—particularly observed on PowerPC platforms

This vulnerability is rated as having a Moderate severity because exploitation requires local access and privileged filesystem operations to mount or replay an ext4 filesystem configured with the non-default fast_commit feature. On Red Hat Enterprise Linux, XFS is the standard default filesystem, and the fast_commit option is not enabled by default on standard ext4 volumes. Consequently, typical system workloads are unaffected unless an administrator explicitly creates or mounts an ext4 filesystem utilizing this specific journaling capability, with the resulting impact limited to a kernel crash and denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.