{"api_version":"1","generated_at":"2026-11-11T01:40:15+00:00","cve":"CVE-2022-49360","urls":{"html":"https://cve.report/CVE-2022-49360","api":"https://cve.report/api/cve/CVE-2022-49360.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-49360","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-49360"},"summary":{"title":"f2fs: fix to do sanity check on total_data_blocks","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to do sanity check on total_data_blocks\n\nAs Yanming reported in bugzilla:\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=215916\n\nThe kernel message is shown below:\n\nkernel BUG at fs/f2fs/segment.c:2560!\nCall Trace:\n allocate_segment_by_default+0x228/0x440\n f2fs_allocate_data_block+0x13d1/0x31f0\n do_write_page+0x18d/0x710\n f2fs_outplace_write_data+0x151/0x250\n f2fs_do_write_data_page+0xef9/0x1980\n move_data_page+0x6af/0xbc0\n do_garbage_collect+0x312f/0x46f0\n f2fs_gc+0x6b0/0x3bc0\n f2fs_balance_fs+0x921/0x2260\n f2fs_write_single_data_page+0x16be/0x2370\n f2fs_write_cache_pages+0x428/0xd00\n f2fs_write_data_pages+0x96e/0xd50\n do_writepages+0x168/0x550\n __writeback_single_inode+0x9f/0x870\n writeback_sb_inodes+0x47d/0xb20\n __writeback_inodes_wb+0xb2/0x200\n wb_writeback+0x4bd/0x660\n wb_workfn+0x5f3/0xab0\n process_one_work+0x79f/0x13e0\n worker_thread+0x89/0xf60\n kthread+0x26a/0x300\n ret_from_fork+0x22/0x30\nRIP: 0010:new_curseg+0xe8d/0x15f0\n\nThe root cause is: ckpt.valid_block_count is inconsistent with SIT table,\nstat info indicates filesystem has free blocks, but SIT table indicates\nfilesystem has no free segment.\n\nSo that during garbage colloection, it triggers panic when LFS allocator\nfails to find free segment.\n\nThis patch tries to fix this issue by checking consistency in between\nckpt.valid_block_count and block accounted from SIT.","state":"PUBLISHED","assigner":"Linux","published_at":"2025-02-26 07:01:12","updated_at":"2026-08-15 13:17:20"},"problem_types":["NVD-CWE-noinfo"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"5.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}}],"references":[{"url":"https://git.kernel.org/stable/c/cc8c9df19971e59ebbe669ce710080e347dfec32","name":"https://git.kernel.org/stable/c/cc8c9df19971e59ebbe669ce710080e347dfec32","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ef221b738b26d8c9f7e7967f4586db2dd3bd5288","name":"https://git.kernel.org/stable/c/ef221b738b26d8c9f7e7967f4586db2dd3bd5288","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/6b8beca0edd32075a769bfe4178ca00c0dcd22a9","name":"https://git.kernel.org/stable/c/6b8beca0edd32075a769bfe4178ca00c0dcd22a9","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/c9e4cd5b0ccd7168801d6a811919171b185c5cf8","name":"https://git.kernel.org/stable/c/c9e4cd5b0ccd7168801d6a811919171b185c5cf8","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/071b1269a3b3ad9cec16ed76a48015bfffd9aee8","name":"https://git.kernel.org/stable/c/071b1269a3b3ad9cec16ed76a48015bfffd9aee8","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-49360","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49360","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 351df4b201157351c7d26bf12c3eeb9dbce98854 ef221b738b26d8c9f7e7967f4586db2dd3bd5288 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 351df4b201157351c7d26bf12c3eeb9dbce98854 c9e4cd5b0ccd7168801d6a811919171b185c5cf8 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 351df4b201157351c7d26bf12c3eeb9dbce98854 071b1269a3b3ad9cec16ed76a48015bfffd9aee8 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 351df4b201157351c7d26bf12c3eeb9dbce98854 cc8c9df19971e59ebbe669ce710080e347dfec32 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 351df4b201157351c7d26bf12c3eeb9dbce98854 6b8beca0edd32075a769bfe4178ca00c0dcd22a9 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3.8","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 3.8 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.121 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.46 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.17.14 5.17.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.18.3 5.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.19 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"49360","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/f2fs/f2fs.h","fs/f2fs/segment.c","fs/f2fs/segment.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ef221b738b26d8c9f7e7967f4586db2dd3bd5288","status":"affected","version":"351df4b201157351c7d26bf12c3eeb9dbce98854","versionType":"git"},{"lessThan":"c9e4cd5b0ccd7168801d6a811919171b185c5cf8","status":"affected","version":"351df4b201157351c7d26bf12c3eeb9dbce98854","versionType":"git"},{"lessThan":"071b1269a3b3ad9cec16ed76a48015bfffd9aee8","status":"affected","version":"351df4b201157351c7d26bf12c3eeb9dbce98854","versionType":"git"},{"lessThan":"cc8c9df19971e59ebbe669ce710080e347dfec32","status":"affected","version":"351df4b201157351c7d26bf12c3eeb9dbce98854","versionType":"git"},{"lessThan":"6b8beca0edd32075a769bfe4178ca00c0dcd22a9","status":"affected","version":"351df4b201157351c7d26bf12c3eeb9dbce98854","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/f2fs/f2fs.h","fs/f2fs/segment.c","fs/f2fs/segment.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.8"},{"lessThan":"3.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.121","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.46","versionType":"semver"},{"lessThanOrEqual":"5.17.*","status":"unaffected","version":"5.17.14","versionType":"semver"},{"lessThanOrEqual":"5.18.*","status":"unaffected","version":"5.18.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"5.19","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.121","versionStartIncluding":"3.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.46","versionStartIncluding":"3.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.17.14","versionStartIncluding":"3.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.18.3","versionStartIncluding":"3.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.19","versionStartIncluding":"3.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to do sanity check on total_data_blocks\n\nAs Yanming reported in bugzilla:\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=215916\n\nThe kernel message is shown below:\n\nkernel BUG at fs/f2fs/segment.c:2560!\nCall Trace:\n allocate_segment_by_default+0x228/0x440\n f2fs_allocate_data_block+0x13d1/0x31f0\n do_write_page+0x18d/0x710\n f2fs_outplace_write_data+0x151/0x250\n f2fs_do_write_data_page+0xef9/0x1980\n move_data_page+0x6af/0xbc0\n do_garbage_collect+0x312f/0x46f0\n f2fs_gc+0x6b0/0x3bc0\n f2fs_balance_fs+0x921/0x2260\n f2fs_write_single_data_page+0x16be/0x2370\n f2fs_write_cache_pages+0x428/0xd00\n f2fs_write_data_pages+0x96e/0xd50\n do_writepages+0x168/0x550\n __writeback_single_inode+0x9f/0x870\n writeback_sb_inodes+0x47d/0xb20\n __writeback_inodes_wb+0xb2/0x200\n wb_writeback+0x4bd/0x660\n wb_workfn+0x5f3/0xab0\n process_one_work+0x79f/0x13e0\n worker_thread+0x89/0xf60\n kthread+0x26a/0x300\n ret_from_fork+0x22/0x30\nRIP: 0010:new_curseg+0xe8d/0x15f0\n\nThe root cause is: ckpt.valid_block_count is inconsistent with SIT table,\nstat info indicates filesystem has free blocks, but SIT table indicates\nfilesystem has no free segment.\n\nSo that during garbage colloection, it triggers panic when LFS allocator\nfails to find free segment.\n\nThis patch tries to fix this issue by checking consistency in between\nckpt.valid_block_count and block accounted from SIT."}],"providerMetadata":{"dateUpdated":"2026-08-15T12:22:37.697Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/ef221b738b26d8c9f7e7967f4586db2dd3bd5288"},{"url":"https://git.kernel.org/stable/c/c9e4cd5b0ccd7168801d6a811919171b185c5cf8"},{"url":"https://git.kernel.org/stable/c/071b1269a3b3ad9cec16ed76a48015bfffd9aee8"},{"url":"https://git.kernel.org/stable/c/cc8c9df19971e59ebbe669ce710080e347dfec32"},{"url":"https://git.kernel.org/stable/c/6b8beca0edd32075a769bfe4178ca00c0dcd22a9"}],"title":"f2fs: fix to do sanity check on total_data_blocks","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2022-49360","datePublished":"2025-02-26T02:11:08.402Z","dateReserved":"2025-02-26T02:08:31.546Z","dateUpdated":"2026-08-15T12:22:37.697Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-02-26 07:01:12","lastModifiedDate":"2026-08-15 13:17:20","problem_types":["NVD-CWE-noinfo"],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"5.10.121","matchCriteriaId":"DD91DA8C-87FE-47CE-A7BA-0480866181FA"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.46","matchCriteriaId":"20D41697-0E8B-4B7D-8842-F17BF2AA21E1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"5.17.14","matchCriteriaId":"15E2DD33-2255-4B76-9C15-04FF8CBAB252"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"5.18.3","matchCriteriaId":"8E122216-2E9E-4B3E-B7B8-D575A45BA3C2"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2022","CveId":"49360","Ordinal":"1","Title":"f2fs: fix to do sanity check on total_data_blocks","CVE":"CVE-2022-49360","Year":"2022"},"notes":[{"CveYear":"2022","CveId":"49360","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to do sanity check on total_data_blocks\n\nAs Yanming reported in bugzilla:\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=215916\n\nThe kernel message is shown below:\n\nkernel BUG at fs/f2fs/segment.c:2560!\nCall Trace:\n allocate_segment_by_default+0x228/0x440\n f2fs_allocate_data_block+0x13d1/0x31f0\n do_write_page+0x18d/0x710\n f2fs_outplace_write_data+0x151/0x250\n f2fs_do_write_data_page+0xef9/0x1980\n move_data_page+0x6af/0xbc0\n do_garbage_collect+0x312f/0x46f0\n f2fs_gc+0x6b0/0x3bc0\n f2fs_balance_fs+0x921/0x2260\n f2fs_write_single_data_page+0x16be/0x2370\n f2fs_write_cache_pages+0x428/0xd00\n f2fs_write_data_pages+0x96e/0xd50\n do_writepages+0x168/0x550\n __writeback_single_inode+0x9f/0x870\n writeback_sb_inodes+0x47d/0xb20\n __writeback_inodes_wb+0xb2/0x200\n wb_writeback+0x4bd/0x660\n wb_workfn+0x5f3/0xab0\n process_one_work+0x79f/0x13e0\n worker_thread+0x89/0xf60\n kthread+0x26a/0x300\n ret_from_fork+0x22/0x30\nRIP: 0010:new_curseg+0xe8d/0x15f0\n\nThe root cause is: ckpt.valid_block_count is inconsistent with SIT table,\nstat info indicates filesystem has free blocks, but SIT table indicates\nfilesystem has no free segment.\n\nSo that during garbage colloection, it triggers panic when LFS allocator\nfails to find free segment.\n\nThis patch tries to fix this issue by checking consistency in between\nckpt.valid_block_count and block accounted from SIT.","Type":"Description","Title":"f2fs: fix to do sanity check on total_data_blocks"}]}}}