CVE-2022-50313: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50313 is a vulnerability in the Linux kernel's EROFS (Extensible Read-Only File System) subsystem where a crafted negative i_size value can trigger an order >= MAX_ORDER kernel warning and unexpected file system behavior. The root cause is that the i_size field is a signed type, and a negative value is also less than EROFS_BLKSIZ, causing the kernel to incorrectly handle the inode as a fast symlink. Affected kernel versions span 4.19 through 6.0.x, with fixed versions at 5.4.289, 5.10.233, 5.15.82, 5.19.17, and 6.0.3. The vulnerability was publicly disclosed on September 15, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The vulnerability is classified under improper handling of signed integer values (related to CWE-190, Integer Overflow/Wraparound). In the EROFS file system driver, the i_size field is a signed type; when a crafted filesystem image contains a negative i_size, the value compares as less than EROFS_BLKSIZ, causing the kernel to misidentify the inode as a fast symlink and attempt to allocate an excessively large memory order, triggering an order >= MAX_ORDER warning. The fix redirects such unusual i_size values to the generic path rather than the fast symlink handler. Exploitation requires local access and the ability to mount or present a crafted EROFS image to the kernel (Feedly, Kernel Patch).

Successful exploitation by a local attacker with the ability to mount a crafted EROFS filesystem image can cause kernel instability or a denial of service condition, as the erroneous memory allocation attempt may trigger a kernel warning or panic. The vulnerability has a high availability impact with no confidentiality or integrity impact, meaning it cannot be used to read or modify data but can disrupt system operation (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and the ability to present a crafted EROFS image to the kernel (Feedly).

Patches are available for all affected Linux kernel stable branches. Administrators should upgrade to the following fixed versions or later: 5.4.289, 5.10.233, 5.15.82, 5.19.17, or 6.0.3. For systems that cannot be immediately patched, restricting local user access and limiting the ability to mount arbitrary filesystems (e.g., via user namespace restrictions or disabling unprivileged FUSE/mount) can reduce exposure. Monitoring for unusual kernel warnings related to EROFS or memory allocation order errors is also advisable (Feedly, Kernel Patch).