CVE-2022-50746: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50746 is a use-after-free vulnerability in the Linux kernel's erofs (Enhanced Read-Only File System) subsystem, caused by improper validation of extent length for uncompressed physical clusters (pclusters). The flaw was discovered via syzkaller fuzzing and involves a condition where the logical length of a pcluster exceeds its physical length, triggering a KASAN-reported use-after-free. It affects Linux kernel versions starting from commit 02827e1796b33f1794966f5c3101f8da2dfa9c1d, with patches available for kernel versions 4.19, 6.0.16, 6.1.2, and 6.2. It was publicly disclosed on December 24, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper input validation (CWE-20) in the erofs filesystem's handling of uncompressed pcluster extents, where the kernel fails to verify that a pcluster's logical length does not exceed its physical length. When a specially crafted or malicious erofs filesystem image is mounted, this mismatch can cause the kernel to access memory beyond the intended buffer boundary, resulting in a use-after-free condition as reported by KASAN. The attack vector is local, requiring the attacker to mount or interact with a crafted erofs image. The syzkaller fuzzer identified the issue via a fuzzed image with two distinct problems: a zero memory address (m_pa == 0) for a non-inlined pcluster (addressed separately) and the logical-exceeds-physical length issue addressed by this patch (Red Hat Bugzilla).

Successful exploitation can cause system instability and denial of service by triggering a kernel use-after-free condition. The vulnerability has a high availability impact, meaning an attacker could crash or destabilize the affected system. There is no confidentiality or integrity impact identified; the primary risk is disruption of system availability (Red Hat Advisory).

Patches are available for multiple Linux kernel stable branches: kernel 6.2 (commit 40c73b2ea961), kernel 6.1.2 (commit c505feba4c0d), kernel 6.0.16 (commit dc8b6bd587b1), and kernel 4.19. Administrators should update to the latest patched kernel version corresponding to their deployment. As a workaround, restricting local user access to mount erofs filesystem images can reduce exposure until patching is feasible (Red Hat Bugzilla, Kernel Patch 6.2).