CVE-2022-50845: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50845 is a Linux kernel vulnerability involving an inode leak in the ext4 filesystem's ext4_xattr_inode_create() function on an error path. When ext4_mark_inode_dirty() fails during an extended attribute (xattr) set operation, the function does not properly drop the i_nlink count of the newly created inode, resulting in an unattached, leaked inode on the filesystem. The vulnerability affects the Linux kernel across multiple stable branches and was published on December 30, 2025. Patches have been backported to stable versions including 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.87, 6.0.18, 6.1.4, and 6.2. The CVSS estimate is Medium severity with an EPSS score of 0.000240 (Feedly, EUVD).

The root cause is improper error handling (CWE-459: Incomplete Cleanup) in the ext4 filesystem's ext4_xattr_inode_create() function within the Linux kernel. When a setxattr operation triggers an error in ext4_mark_inode_dirty(), the function returns without decrementing the i_nlink count of the newly allocated inode, leaving it orphaned on the filesystem. This can be reproduced by injecting faults during setxattr operations, after which fsck.ext4 reports unattached zero-length inodes. The fix requires explicitly dropping i_nlink on the error path to ensure proper inode cleanup (Feedly, Kernel Stable).

Exploitation of this vulnerability leads to filesystem corruption in the form of leaked, unattached inodes on ext4-formatted volumes. The primary impact is on filesystem integrity and availability — over time, inode leaks can exhaust the inode table, potentially causing denial of service for processes attempting to create new files. Confidentiality and lateral movement risks are minimal, as this is a local filesystem resource management flaw rather than a code execution or privilege escalation vulnerability (Feedly).

• File System: Presence of unattached zero-length inodes detected by fsck.ext4 -fn <device>, reported as "Unattached zero-length inode" or "Unattached inode" in fsck output.
• Logs: Kernel error messages related to ext4_mark_inode_dirty() failures during setxattr operations visible in dmesg or /var/log/kern.log.
• File System: Discrepancies in inode counts reported by df -i or tune2fs -l compared to expected values, indicating inode exhaustion or leakage over time.

Apply the upstream kernel patches that fix the error path in ext4_xattr_inode_create() by ensuring i_nlink is dropped when ext4_mark_inode_dirty() fails. Fixed versions are available in stable kernel releases: 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.87, 6.0.18, 6.1.4, and 6.2. Users should update to a patched kernel version provided by their Linux distribution. As a temporary measure, periodic fsck.ext4 checks can identify and clear leaked inodes, though this does not prevent the underlying issue (Feedly, Kernel Stable).