CVE-2022-50435: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50435 is a vulnerability in the Linux kernel's ext4 filesystem that was disclosed on October 1, 2025. The vulnerability occurs when an inode is created and written to using direct IO, where the EXT4_STATE_MAY_INLINE_DATA flag is not properly cleared (NVD).

The vulnerability manifests when an inode gets truncated to a small size (e.g., 1 byte) and written using normal write after being created with direct IO. This causes confusion in the code as the inode has both normal block and inline data allocated, leading to a kernel crash at fs/ext4/inode.c:2721. The issue has been assigned a CVSS v3.1 score of 7.0 (High) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (RedHat).

When exploited, this vulnerability can cause a kernel crash, leading to system instability and potential denial of service. The crash occurs in the ext4_writepages function, affecting the system's ability to properly handle file operations (NVD).

The vulnerability has been fixed by clearing the EXT4_STATE_MAY_INLINE_DATA flag when performing direct IO write to a file. Users are advised to update their Linux kernel to a patched version (NVD).