CVE-2022-49879: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49879 is a vulnerability in the Linux kernel's ext4 filesystem implementation, discovered and disclosed on May 1, 2025. The vulnerability affects the directory entry handling mechanism in the ext4 filesystem, specifically when the rec_len field in directory entries contains invalid values that are not multiples of 4 (NVD, Red Hat).

The vulnerability occurs in the ext4_rec_len_to_disk() function, called from make_indexed_dir(), where a corrupted filesystem image can trigger a BUG() condition. The issue manifests when the rec_len field in a directory entry is not a multiple of 4, which is a requirement for valid entries. This condition triggers a kernel BUG_ON() at fs/ext4/ext4.h:2413. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) (Red Hat).

When exploited, this vulnerability can lead to a denial of service condition by triggering a kernel panic, resulting in system crash. The attack requires a specially crafted filesystem image to be mounted on the affected system (Wiz).

The vulnerability has been patched by adding a call to ext4_check_dir_entry() to validate the directory entry, which returns -EFSCORRUPTED if the entry is invalid. This validation prevents the system from crashing when encountering malformed directory entries (NVD, Red Hat).