CVE-2022-50126: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50126 is a reachable assertion vulnerability in the Linux kernel's jbd2 (Journal Block Device 2) subsystem that can cause a kernel panic and system crash. The flaw exists in the jbd2_journal_dirty_metadata() function, where a race condition between file unlinking operations and journal transaction management triggers a failed assertion (jh->b_frozen_data == NULL) when the journal is aborted. Affected kernel versions span from 2.6.19-rc3 through 4.14.290, 4.15–4.19.255, 4.20–5.4.210, 5.5–5.10.136, 5.11–5.15.60, 5.16–5.18.17, and 5.19–5.19.1. It was published on June 18, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is classified as CWE-617 (Reachable Assertion). The vulnerability arises from a timing window in which two concurrent unlink() operations on different directory entries interact with an in-progress journal commit (jbd2_journal_commit_transaction). Specifically, when the journal is aborted mid-commit, __jbd2_journal_refile_buffer() moves a journal head (jh) with non-NULL b_frozen_data to the BJ_Reserved list, after which jbd2_journal_dirty_metadata() hits the assertion J_ASSERT_JH(jh, jh->b_frozen_data == NULL) at fs/jbd2/transaction.c:1629, resulting in a kernel BUG. Exploitation requires local access with low privileges and low attack complexity, and is limited to systems using ext4 filesystems with journaling enabled (Feedly).

Successful exploitation causes a kernel panic (BUG at fs/jbd2/transaction.c:1629), resulting in a complete denial of service (system crash) on the affected host. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Systems running ext4 with journaling (the default configuration for most Linux distributions) are at risk, and repeated triggering could be used to persistently destabilize a target system (Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), reflecting very low probability of exploitation in the near term. Exploitation requires local, low-privilege access, further limiting the practical attack surface (Feedly).

Patches have been released for all affected stable kernel branches. Fixed versions include: 4.14.291, 4.19.256, 5.4.211, 5.10.137, 5.15.61, 5.18.18, and 5.19.2. Administrators should update to the latest stable kernel version for their distribution. SUSE has issued a vendor advisory (SUSE-2025-02308-1) addressing this and related kernel issues. As a temporary measure, limiting local user access to affected systems and monitoring for unexpected kernel panics or jbd2-related errors in system logs is recommended (Feedly, SUSE Advisory).

SUSE issued a kernel security update (SUSE-2025-02308-1) rated "Important" that addresses CVE-2022-50126 among other kernel vulnerabilities (SUSE Advisory). No notable independent researcher commentary or significant social media discussion has been observed for this vulnerability.