CVE-2022-50673: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50673 is a use-after-free vulnerability in the Linux kernel's ext4 filesystem subsystem, specifically within the ext4_orphan_cleanup function. The flaw was published on December 9, 2025, and affects the Linux kernel across multiple stable branches. It is classified as Medium severity with an EPSS score of 0.000240, indicating low probability of active exploitation (Feedly). Vendor patches have been issued by Red Hat, SUSE, AlmaLinux, Rocky Linux, and Oracle Linux (Red Hat).

The vulnerability is a use-after-free (CWE-416) in the ext4_orphan_cleanup function, triggered during filesystem mount when processing orphan inodes. The bug occurs in a loop where, if ext4_inode_attach_jinode() returns -ENOMEM during ext4_truncate, the inode is freed via iput(), but the last_orphan pointer still references the freed inode's block number. On the next loop iteration, the kernel attempts to add the already-freed inode to the orphan list via list_add(), resulting in a KASAN-detected use-after-free read at the freed memory address. The issue was confirmed with a KASAN report showing a read of size 8 at a freed address during a mount operation on a crafted ext4 filesystem (Feedly).

Successful exploitation of this vulnerability can lead to kernel memory corruption, potentially causing a system crash (denial of service) or, in more severe scenarios, privilege escalation if the freed memory is reclaimed and manipulated by an attacker. The vulnerability is triggered during the mounting of a specially crafted ext4 filesystem image, meaning an attacker with the ability to mount filesystems (e.g., a local user with sufficient privileges or via removable media auto-mount) could trigger the condition. Confidentiality and integrity impacts are possible if the use-after-free is leveraged for arbitrary kernel memory read/write primitives (Feedly).

Patches addressing CVE-2022-50673 have been released by multiple Linux distributions. Red Hat has issued advisories including RHSA-2026:2264, RHSA-2026:2378, RHSA-2026:2490, RHSA-2026:2577, RHSA-2026:2664, RHSA-2026:3267, RHSA-2026:3277, RHSA-2026:3358, RHSA-2026:3360, RHSA-2026:3634, RHSA-2026:3685 (Red Hat). SUSE, AlmaLinux, Rocky Linux, and Oracle Linux have also released corresponding kernel updates (Feedly). The upstream fix is available in the Linux kernel stable tree. Administrators should apply the latest kernel updates for their distribution and, as a short-term workaround, restrict unprivileged users from mounting ext4 filesystems (e.g., via nosuid/nodev mount policies or disabling user-namespace-based mounts).