Skip to content
OpenAdvisories
Unscored CVE-2022-50546 EUVD-2025-32001GHSA-g2jp-ch4j-rcfr

ext4: fix uninititialized value in 'ext4_evict_inode'

Published Oct 7, 2025 · Updated May 23, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.15 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-fips Package: linux-aws-hwe Package: linux-azure Package: linux-azure-4.15 Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.15 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-azure-fips Package: linux-bluefield Package: linux-fips Package: linux-gcp Package: linux-gcp-4.15 Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.15 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-fips Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.15 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-edge Package: linux-ibm Package: linux-intel Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-intel-iotg Package: linux-intel-iotg-5.15 Package: linux-kvm Package: linux-lowlatency Package: linux-lowlatency-hwe-5.15 Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-nvidia Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-nvidia-tegra-5.15 Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.11 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.15 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.5 Package: linux-raspi Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.15 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.5 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-vmware Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix uninititialized value in 'ext4_evict_inode'

Syzbot found the following issue:
=====================================================
BUG: KMSAN: uninit-value in ext4_evict_inode+0xdd/0x26b0 fs/ext4/inode.c:180
ext4_evict_inode+0xdd/0x26b0 fs/ext4/inode.c:180
evict+0x365/0x9a0 fs/inode.c:664
iput_final fs/inode.c:1747 [inline]
iput+0x985/0xdd0 fs/inode.c:1773
__ext4_new_inode+0xe54/0x7ec0 fs/ext4/ialloc.c:1361
ext4_mknod+0x376/0x840 fs/ext4/namei.c:2844
vfs_mknod+0x79d/0x830 fs/namei.c:3914
do_mknodat+0x47d/0xaa0
__do_sys_mknodat fs/namei.c:3992 [inline]
__se_sys_mknodat fs/namei.c:3989 [inline]
__ia32_sys_mknodat+0xeb/0x150 fs/namei.c:3989
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203
do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:246
entry_SYSENTER_compat_after_hwframe+0x70/0x82

Uninit was created at:
__alloc_pages+0x9f1/0xe80 mm/page_alloc.c:5578
alloc_pages+0xaae/0xd80 mm/mempolicy.c:2285
alloc_slab_page mm/slub.c:1794 [inline]
allocate_slab+0x1b5/0x1010 mm/slub.c:1939
new_slab mm/slub.c:1992 [inline]
___slab_alloc+0x10c3/0x2d60 mm/slub.c:3180
__slab_alloc mm/slub.c:3279 [inline]
slab_alloc_node mm/slub.c:3364 [inline]
slab_alloc mm/slub.c:3406 [inline]
__kmem_cache_alloc_lru mm/slub.c:3413 [inline]
kmem_cache_alloc_lru+0x6f3/0xb30 mm/slub.c:3429
alloc_inode_sb include/linux/fs.h:3117 [inline]
ext4_alloc_inode+0x5f/0x860 fs/ext4/super.c:1321
alloc_inode+0x83/0x440 fs/inode.c:259
new_inode_pseudo fs/inode.c:1018 [inline]
new_inode+0x3b/0x430 fs/inode.c:1046
__ext4_new_inode+0x2a7/0x7ec0 fs/ext4/ialloc.c:959
ext4_mkdir+0x4d5/0x1560 fs/ext4/namei.c:2992
vfs_mkdir+0x62a/0x870 fs/namei.c:4035
do_mkdirat+0x466/0x7b0 fs/namei.c:4060
__do_sys_mkdirat fs/namei.c:4075 [inline]
__se_sys_mkdirat fs/namei.c:4073 [inline]
__ia32_sys_mkdirat+0xc4/0x120 fs/namei.c:4073
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203
do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:246
entry_SYSENTER_compat_after_hwframe+0x70/0x82

CPU: 1 PID: 4625 Comm: syz-executor.2 Not tainted 6.1.0-rc4-syzkaller-62821-gcb231e2f67ec #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
=====================================================

Now, 'ext4_alloc_inode()' didn't init 'ei->i_flags'. If new inode failed
before set 'ei->i_flags' in '__ext4_new_inode()', then do 'iput()'. As after
6bc0d63dad7f commit will access 'ei->i_flags' in 'ext4_evict_inode()' which
will lead to access uninit-value.
To solve above issue just init 'ei->i_flags' in 'ext4_alloc_inode()'.

Affected products

VendorProductAffectedFixed
Linux Linux 5.10.163 – < 5.10.164, 5.15.61 – < 5.15.87, 5.18.18 – < 5.19, 5.19.2 – < 5.20, 6.0 5.10.164

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 6.1.4-1 —
Debian 13 linux 6.1.4-1 —
Debian 12 linux 6.1.4-1 —
ReleasePackageFixed inAdvisory
Ubuntu Nvidia-BlueField 22.04 LTS linux-bluefield 5.15.0-1015.17 —
Ubuntu 24.04 LTS linux-intel +9 No fix yet —
Ubuntu 22.04 LTS linux +1 5.15.0-69.76 —
Ubuntu 22.04 LTS linux-aws 5.15.0-1033.37 —
Ubuntu 22.04 LTS linux-azure 5.15.0-1035.42 —
Ubuntu 22.04 LTS linux-azure-fde 5.15.0-1035.42.1 —
Ubuntu 22.04 LTS linux-gcp 5.15.0-1031.38 —
Ubuntu 22.04 LTS linux-gke +1 5.15.0-1030.35 —
Ubuntu 22.04 LTS linux-gkeop 5.15.0-1017.22 —
Ubuntu 22.04 LTS linux-ibm 5.15.0-1027.30 —
Ubuntu 22.04 LTS linux-intel-iotg 5.15.0-1027.32 —
Ubuntu 22.04 LTS linux-nvidia 5.15.0-1023.23 —
Ubuntu 22.04 LTS linux-oracle 5.15.0-1032.38 —
Ubuntu 22.04 LTS linux-raspi 5.15.0-1026.28 —
Ubuntu 22.04 LTS linux-riscv +32 No fix yet —
Ubuntu 20.04 LTS linux-aws-5.15 5.15.0-1033.37~20.04.1 —
Ubuntu 20.04 LTS linux-azure-5.15 5.15.0-1035.42~20.04.1 —
Ubuntu 20.04 LTS linux-gcp-5.15 5.15.0-1031.38~20.04.1 —
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Ubuntu 20.04 LTS linux-hwe-5.15 +1 5.15.0-69.76~20.04.1 —
Ubuntu 20.04 LTS linux-intel-iotg-5.15 5.15.0-1027.32~20.04.1 —
Ubuntu 20.04 LTS linux-nvidia-tegra-5.15 5.15.0-1014.14~20.04.1 —
Ubuntu 20.04 LTS linux-oracle-5.15 5.15.0-1032.38~20.04.1 —
Ubuntu 20.04 LTS linux-riscv-5.15 5.15.0-1030.34~20.04.1 —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Ubuntu Pro Realtime 22.04 LTS linux-intel-iot-realtime 5.15.0-1023.28 —
Ubuntu Pro Realtime 22.04 LTS linux-realtime 5.15.0-1034.37 —
Ubuntu Pro FIPS-updates 18.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro 18.04 LTS linux +5 No fix yet —
Ubuntu Pro 16.04 LTS linux-gcp +4 No fix yet —
Ubuntu Pro 14.04 LTS linux-azure No fix yet —
ReleasePackageFixed inAdvisory
RHEL 9 bpftool 7.0.0-284.11.1.el9_2 RHSA-2023:2458
RHEL 9 perf +48 5.14.0-284.11.1.el9_2 RHSA-2023:2458
RHEL 8 perf +26 4.18.0-553.el8_10 RHSA-2024:3138

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 8 kernel 4.18.0-553.123.1.el8_10.cloud.0.1 RXSA-2024:3138
ReleasePackageFixed inAdvisory
SLES 15 SP5 kernel-64kb +6 5.14.21-150500.55.127.1 SUSE-SU-2025:4320-1
SLES 15 SP5 kernel-default-base 5.14.21-150500.55.127.1.150500.6.61.1 SUSE-SU-2025:4320-1
SLES 15 SP4 kernel-64kb +6 5.14.21-150400.24.184.1 SUSE-SU-2025:4111-1
SLES 15 SP4 kernel-default-base 5.14.21-150400.24.184.1.150400.24.94.2 SUSE-SU-2025:4111-1
SLES 15 SP3 kernel-64kb +5 5.3.18-150300.59.226.2 SUSE-SU-2025:4188-1
SLES 15 SP3 kernel-default-base 5.3.18-150300.59.226.2.150300.18.134.2 SUSE-SU-2025:4188-1
SLES 15 SP3 kernel-docs 5.3.18-150300.59.226.3 SUSE-SU-2025:4188-1
SLES 15 SP3 kernel-syms 5.3.18-150300.59.226.1 SUSE-SU-2025:4188-1
Show 16 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP5 kernel-default-base 5.14.21-150500.55.127.1.150500.6.61.1 SUSE-SU-2025:4320-1
SLES for SAP 15 SP5 kernel-docs +4 5.14.21-150500.55.127.1 SUSE-SU-2025:4320-1
SLES for SAP 15 SP4 kernel-default-base 5.14.21-150400.24.184.1.150400.24.94.2 SUSE-SU-2025:4111-1
SLES for SAP 15 SP4 kernel-docs +4 5.14.21-150400.24.184.1 SUSE-SU-2025:4111-1
SLES for SAP 15 SP3 kernel-default-base 5.3.18-150300.59.226.2.150300.18.134.2 SUSE-SU-2025:4188-1
SLES for SAP 15 SP3 kernel-docs 5.3.18-150300.59.226.3 SUSE-SU-2025:4188-1
SLES for SAP 15 SP3 kernel-source +3 5.3.18-150300.59.226.2 SUSE-SU-2025:4188-1
SLES for SAP 15 SP3 kernel-syms 5.3.18-150300.59.226.1 SUSE-SU-2025:4188-1
SLE Micro 5.5 kernel-default-base 5.14.21-150500.55.127.1.150500.6.61.1 SUSE-SU-2025:4320-1
SLE Micro 5.5 kernel-rt +1 5.14.21-150500.13.112.1 SUSE-SU-2025:4149-1
SLE Micro 5.5 kernel-source +1 5.14.21-150500.55.127.1 SUSE-SU-2025:4320-1
SLE Micro 5.4 kernel-default 5.14.21-150400.24.184.1 SUSE-SU-2025:4111-1
SLE Micro 5.4 kernel-default-base 5.14.21-150400.24.184.1.150400.24.94.2 SUSE-SU-2025:4111-1
SLE Micro 5.4 kernel-rt +1 5.14.21-150400.15.136.1 SUSE-SU-2025:4139-1
SLE Micro 5.3 kernel-default 5.14.21-150400.24.184.1 SUSE-SU-2025:4111-1
SLE Micro 5.3 kernel-default-base 5.14.21-150400.24.184.1.150400.24.94.2 SUSE-SU-2025:4111-1
SLE Micro 5.3 kernel-rt +1 5.14.21-150400.15.136.1 SUSE-SU-2025:4139-1
SLE Micro 5.2 kernel-default 5.3.18-150300.59.226.2 SUSE-SU-2025:4188-1
SLE Micro 5.2 kernel-default-base 5.3.18-150300.59.226.2.150300.18.134.2 SUSE-SU-2025:4188-1
SLE Micro 5.2 kernel-rt +1 5.3.18-150300.226.1 SUSE-SU-2025:4135-1
SLE Live Patching 15 SP5 kernel-default 5.14.21-150500.55.127.1 SUSE-SU-2025:4320-1
SLE Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_32 1-150500.11.3.1 SUSE-SU-2025:4320-1
SLE Live Patching 15 SP4 kernel-default 5.14.21-150400.24.184.1 SUSE-SU-2025:4111-1
SLE Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_46 1-150400.9.5.1 SUSE-SU-2025:4111-1
SLE Live Patching 15 SP3 kernel-default 5.3.18-150300.59.226.2 SUSE-SU-2025:4188-1
SLE Live Patching 15 SP3 kernel-livepatch-SLE15-SP3_Update_63 1-150300.7.5.2 SUSE-SU-2025:4188-1
SLE HPC 15 SP5 kernel-64kb +5 5.14.21-150500.55.127.1 SUSE-SU-2025:4320-1
SLE HPC 15 SP5 kernel-default-base 5.14.21-150500.55.127.1.150500.6.61.1 SUSE-SU-2025:4320-1
SLE HPC 15 SP4 kernel-64kb +5 5.14.21-150400.24.184.1 SUSE-SU-2025:4111-1
SLE HPC 15 SP4 kernel-default-base 5.14.21-150400.24.184.1.150400.24.94.2 SUSE-SU-2025:4111-1
SLE HPC 15 SP3 kernel-64kb +4 5.3.18-150300.59.226.2 SUSE-SU-2025:4188-1
SLE HPC 15 SP3 kernel-default-base 5.3.18-150300.59.226.2.150300.18.134.2 SUSE-SU-2025:4188-1
SLE HPC 15 SP3 kernel-docs 5.3.18-150300.59.226.3 SUSE-SU-2025:4188-1
SLE HPC 15 SP3 kernel-syms 5.3.18-150300.59.226.1 SUSE-SU-2025:4188-1
SUSE Manager Server LTS 4.3 kernel-default-base 5.14.21-150400.24.184.1.150400.24.94.2 SUSE-SU-2025:4111-1
SUSE Manager Server LTS 4.3 kernel-syms +3 5.14.21-150400.24.184.1 SUSE-SU-2025:4111-1
SUSE Manager Proxy LTS 4.3 kernel-default-base 5.14.21-150400.24.184.1.150400.24.94.2 SUSE-SU-2025:4111-1
SUSE Manager Proxy LTS 4.3 kernel-syms +2 5.14.21-150400.24.184.1 SUSE-SU-2025:4111-1
SUSE Enterprise Storage 7.1 kernel-64kb +4 5.3.18-150300.59.226.2 SUSE-SU-2025:4188-1
SUSE Enterprise Storage 7.1 kernel-default-base 5.3.18-150300.59.226.2.150300.18.134.2 SUSE-SU-2025:4188-1
SUSE Enterprise Storage 7.1 kernel-docs 5.3.18-150300.59.226.3 SUSE-SU-2025:4188-1
SUSE Enterprise Storage 7.1 kernel-syms 5.3.18-150300.59.226.1 SUSE-SU-2025:4188-1

Advisories 10

References