Skip to content
OpenAdvisories
Unscored CVE-2022-50277 EUVD-2022-55578GHSA-5935-5rv9-4v2p

ext4: don't allow journal inode to have encrypt flag

Published Sep 15, 2025 · Updated May 11, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-edge Package: linux-intel Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.11 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.5 Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.5 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

ext4: don't allow journal inode to have encrypt flag

Mounting a filesystem whose journal inode has the encrypt flag causes a
NULL dereference in fscrypt_limit_io_blocks() when the 'inlinecrypt'
mount option is used.

The problem is that when jbd2_journal_init_inode() calls bmap(), it
eventually finds its way into ext4_iomap_begin(), which calls
fscrypt_limit_io_blocks(). fscrypt_limit_io_blocks() requires that if
the inode is encrypted, then its encryption key must already be set up.
That's not the case here, since the journal inode is never "opened" like
a normal file would be. Hence the crash.

A reproducer is:

mkfs.ext4 -F /dev/vdb
debugfs -w /dev/vdb -R "set_inode_field <8> flags 0x80808"
mount /dev/vdb /mnt -o inlinecrypt

To fix this, make ext4 consider journal inodes with the encrypt flag to
be invalid. (Note, maybe other flags should be rejected on the journal
inode too. For now, this is just the minimal fix for the above issue.)

I've marked this as fixing the commit that introduced the call to
fscrypt_limit_io_blocks(), since that's what made an actual crash start
being possible. But this fix could be applied to any version of ext4
that supports the encrypt feature.

Affected products

VendorProductAffectedFixed
Linux Linux 5.18 6.0.18

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 6.1.4-1 —
Debian 13 linux 6.1.4-1 —
Debian 12 linux 6.1.4-1 —
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS linux-intel +9 No fix yet —
Ubuntu 22.04 LTS linux-riscv +32 No fix yet —
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
ReleasePackageFixed inAdvisory
RHEL 9 bpftool 7.3.0-427.13.1.el9_4 RHSA-2024:2394
RHEL 9 rv +64 5.14.0-427.13.1.el9_4 RHSA-2024:2394
ReleasePackageFixed inAdvisory
SLES 15 SP5 kernel-64kb +6 5.14.21-150500.55.124.1 SUSE-SU-2025:03615-1
SLES 15 SP5 kernel-default-base 5.14.21-150500.55.124.1.150500.6.59.1 SUSE-SU-2025:03615-1
SLES 15 SP4 kernel-64kb +6 5.14.21-150400.24.179.1 SUSE-SU-2025:03628-1
SLES 15 SP4 kernel-default-base 5.14.21-150400.24.179.1.150400.24.92.1 SUSE-SU-2025:03628-1
Show 11 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP5 kernel-default-base 5.14.21-150500.55.124.1.150500.6.59.1 SUSE-SU-2025:03615-1
SLES for SAP 15 SP5 kernel-docs +4 5.14.21-150500.55.124.1 SUSE-SU-2025:03615-1
SLES for SAP 15 SP4 kernel-default-base 5.14.21-150400.24.179.1.150400.24.92.1 SUSE-SU-2025:03628-1
SLES for SAP 15 SP4 kernel-docs +4 5.14.21-150400.24.179.1 SUSE-SU-2025:03628-1
SLE Micro 5.5 kernel-default-base 5.14.21-150500.55.124.1.150500.6.59.1 SUSE-SU-2025:03615-1
SLE Micro 5.5 kernel-rt +1 5.14.21-150500.13.109.1 SUSE-SU-2025:3761-1
SLE Micro 5.5 kernel-source +1 5.14.21-150500.55.124.1 SUSE-SU-2025:03615-1
SLE Micro 5.4 kernel-default 5.14.21-150400.24.179.1 SUSE-SU-2025:03628-1
SLE Micro 5.4 kernel-default-base 5.14.21-150400.24.179.1.150400.24.92.1 SUSE-SU-2025:03628-1
SLE Micro 5.4 kernel-rt +1 5.14.21-150400.15.133.1 SUSE-SU-2025:3716-1
SLE Micro 5.3 kernel-default 5.14.21-150400.24.179.1 SUSE-SU-2025:03628-1
SLE Micro 5.3 kernel-default-base 5.14.21-150400.24.179.1.150400.24.92.1 SUSE-SU-2025:03628-1
SLE Micro 5.3 kernel-rt +1 5.14.21-150400.15.133.1 SUSE-SU-2025:3716-1
SLE Live Patching 15 SP5 kernel-default 5.14.21-150500.55.124.1 SUSE-SU-2025:03615-1
SLE Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_31 1-150500.11.3.1 SUSE-SU-2025:03615-1
SLE Live Patching 15 SP4 kernel-default 5.14.21-150400.24.179.1 SUSE-SU-2025:03628-1
SLE Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_45 1-150400.9.3.1 SUSE-SU-2025:03628-1
SLE HPC 15 SP5 kernel-64kb +5 5.14.21-150500.55.124.1 SUSE-SU-2025:03615-1
SLE HPC 15 SP5 kernel-default-base 5.14.21-150500.55.124.1.150500.6.59.1 SUSE-SU-2025:03615-1
SLE HPC 15 SP4 kernel-64kb +5 5.14.21-150400.24.179.1 SUSE-SU-2025:03628-1
SLE HPC 15 SP4 kernel-default-base 5.14.21-150400.24.179.1.150400.24.92.1 SUSE-SU-2025:03628-1
SUSE Manager Server LTS 4.3 kernel-default-base 5.14.21-150400.24.179.1.150400.24.92.1 SUSE-SU-2025:03628-1
SUSE Manager Server LTS 4.3 kernel-syms +3 5.14.21-150400.24.179.1 SUSE-SU-2025:03628-1
SUSE Manager Proxy LTS 4.3 kernel-default-base 5.14.21-150400.24.179.1.150400.24.92.1 SUSE-SU-2025:03628-1
SUSE Manager Proxy LTS 4.3 kernel-syms +2 5.14.21-150400.24.179.1 SUSE-SU-2025:03628-1

Advisories 6

References