CVE-2022-49738: 
Linux Debian vulnerability analysis and mitigation

A vulnerability in the Linux kernel's F2FS (Flash-Friendly File System) was identified as CVE-2022-49738. The issue involves a missing sanity check on i_extra_isize in the is_alive() function, which was discovered by syzbot. The vulnerability was publicly disclosed on March 27, 2025 (NVD).

The vulnerability manifests as a KASAN slab-out-of-bounds error in multiple functions including data_blkaddr (fs/f2fs/f2fs.h:2891), is_alive (fs/f2fs/gc.c:1117), gc_data_segment (fs/f2fs/gc.c:1520), and do_garbage_collect (fs/f2fs/gc.c:1734). The issue occurs due to a lack of proper validation of i_extra_isize, leading to invalid address access during garbage collection operations (NVD).

When exploited, this vulnerability can cause the system to crash due to accessing invalid memory addresses during F2FS garbage collection operations (NVD).

The vulnerability requires local access to the system to be exploited. Red Hat has assigned it a CVSS v3 Base Score of 5.5 (Red Hat).

The vulnerability has been resolved in the Linux kernel through a patch that implements proper sanity checks on i_extra_isize in the is_alive() function (NVD).