CVE-2022-50428: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50428 is a vulnerability in the Linux kernel's ext4 filesystem implementation, specifically related to off-by-one errors in fast-commit block filling. The vulnerability was disclosed on October 1, 2025, affecting the ext4 filesystem's fast-commit feature (NVD).

The vulnerability stems from several off-by-one errors in how fast-commit blocks are filled with TLV (Type-Length-Value) entries. The specific constraints include: TLVs must start at least 10 bytes before the end of the block (despite minimum TLV length being 8), and TLVs must end at least 1 byte before the end of the block. The bug could potentially be triggered if ext4fcreserve_space() is called with a length of blocksize - 9 or blocksize - 8. The vulnerability has been assigned a CVSS v3.1 base score of 5.5, indicating moderate severity (RedHat).

The vulnerability could lead to uninitialized memory being leaked to disk in the last byte of blocks. Additionally, old kernels will be unable to replay fast-commit journals created by kernels that have the fix implemented (NVD).

Red Hat Enterprise Linux versions 6, 7, and 8 are not affected by this vulnerability. For Red Hat Enterprise Linux 9, the fix has been deferred for both kernel and kernel-rt packages (RedHat).