CVE-2022-50638: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50638 is a Linux kernel vulnerability in the ext4 filesystem subsystem that causes a kernel BUG (panic) in __es_tree_search when processing a malformed or corrupted boot loader inode. The flaw was published on December 9, 2025, and affects the Linux kernel's ext4 extent status tree handling code in fs/ext4/extents_status.c. It is estimated as Medium severity with an EPSS score of 0.033% (Feedly).

The root cause is improper validation of extent data associated with a bad boot loader inode in the ext4 filesystem. When ext4_es_cache_extent() is called during a read operation (e.g., via ext4_mpage_readpages), it invokes __es_tree_search, which calls ext4_es_end(). If the inode contains an invalid extent with an end block value of 0xFFFFFFFF, the end-of-extent check triggers a BUG_ON assertion at fs/ext4/extents_status.c:203, causing a kernel panic. The call chain observed is: ext4_mpage_readpages → ext4_map_blocks → ext4_ext_map_blocks → ext4_find_extent → ext4_cache_extents → ext4_es_cache_extent → __es_tree_search → ext4_es_end. This is classified as an improper input validation issue (CWE-20) triggered by a locally mounted or crafted ext4 filesystem image (Feedly).

Successful triggering of this vulnerability causes a kernel BUG/panic, resulting in a system crash and denial of service. An attacker or unprivileged user with the ability to mount or access a crafted ext4 filesystem image could crash the host kernel, impacting availability. There is no evidence of confidentiality or integrity impact beyond the system crash (Feedly).

No public exploit code or in-the-wild exploitation has been reported for CVE-2022-50638. The EPSS score is approximately 0.033%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the ability to mount or cause the kernel to process a specially crafted ext4 filesystem image with a malformed boot loader inode (Feedly).

The Linux kernel maintainers have issued fixes via stable tree commits (e.g., 5f8d36abd205, 71e99ec1315f, 78e335fb573e, 991ed014de08, a95ba369255d) that add proper validation of boot loader inode extents before caching them in the extent status tree. Distributions including SUSE have released updated kernel packages addressing this CVE (e.g., SUSE advisories SUSE-2026:0263-1, SUSE-2026:0317-1, SUSE-2026:0411-1). Users should update to a patched kernel version provided by their Linux distribution as soon as possible (Feedly, Linux Security SUSE).