jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 5 fixed, 4 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-617.
Summary
In the Linux kernel, the following vulnerability has been resolved: jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted Following process will fail assertion 'jh->b_frozen_data == NULL' in jbd2_journal_dirty_metadata(): jbd2_journal_commit_transaction unlink(dir/a) jh->b_transaction = trans1 jh->b_jlist = BJ_Metadata journal->j_running_transaction = NULL trans1->t_state = T_COMMIT unlink(dir/b) handle->h_trans = trans2 do_get_write_access jh->b_modified = 0 jh->b_frozen_data = frozen_buffer jh->b_next_transaction = trans2 jbd2_journal_dirty_metadata is_handle_aborted is_journal_aborted // return false --> jbd2 abort <-- while (commit_transaction->t_buffers) if (is_journal_aborted) jbd2_journal_refile_buffer __jbd2_journal_refile_buffer WRITE_ONCE(jh->b_transaction, jh->b_next_transaction) WRITE_ONCE(jh->b_next_transaction, NULL) __jbd2_journal_file_buffer(jh, BJ_Reserved) J_ASSERT_JH(jh, jh->b_frozen_data == NULL) // assertion failure ! The reproducer (See detail in [Link]) reports: ------------[ cut here ]------------ kernel BUG at fs/jbd2/transaction.c:1629! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 2 PID: 584 Comm: unlink Tainted: G W 5.19.0-rc6-00115-g4a57a8400075-dirty #697 RIP: 0010:jbd2_journal_dirty_metadata+0x3c5/0x470 RSP: 0018:ffffc90000be7ce0 EFLAGS: 00010202 Call Trace: <TASK> __ext4_handle_dirty_metadata+0xa0/0x290 ext4_handle_dirty_dirblock+0x10c/0x1d0 ext4_delete_entry+0x104/0x200 __ext4_unlink+0x22b/0x360 ext4_unlink+0x275/0x390 vfs_unlink+0x20b/0x4c0 do_unlinkat+0x42f/0x4c0 __x64_sys_unlink+0x37/0x50 do_syscall_64+0x35/0x80 After journal aborting, __jbd2_journal_refile_buffer() is executed with holding @jh->b_state_lock, we can fix it by moving 'is_handle_aborted()' into the area protected by @jh->b_state_lock.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Linux | Linux | 2.6.19 and later | 4.14.291, 4.19.256, 5.4.211, 5.10.137, 5.15.61, 5.18.18, 5.19.2, 6.0 | Patch available | CNA |
- Linux VendorLinux Affected 2.6.19 and later Fixed in 4.14.291, 4.19.256, 5.4.211, 5.10.137, 5.15.61, 5.18.18, 5.19.2, 6.0 Patch available CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 2.6.20 to before 4.14.291; 4.15 to before 4.19.256; 4.20 to before 5.4.211; 5.5 to before 5.10.137; 5.11 to before 5.15.61; 5.16 to before 5.18.18; 5.19 to before 5.19.2 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:2.6.19:-:*:*:*:*:*:* | 2.6.19 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:2.6.19:rc2:*:*:*:*:*:* | 2.6.19 rc2 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:2.6.19:rc3:*:*:*:*:*:* | 2.6.19 rc3 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:2.6.19:rc4:*:*:*:*:*:* | 2.6.19 rc4 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:2.6.19:rc5:*:*:*:*:*:* | 2.6.19 rc5 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:2.6.19:rc6:*:*:*:*:*:* | 2.6.19 rc6 | Vulnerable | Linux |
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 2.6.20 to before 4.14.291; 4.15 to before 4.19.256; 4.20 to before 5.4.211; 5.5 to before 5.10.137; 5.11 to before 5.15.61; 5.16 to before 5.18.18; 5.19 to before 5.19.2 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:2.6.19:-:*:*:*:*:*:* Versions 2.6.19 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:2.6.19:rc2:*:*:*:*:*:* Versions 2.6.19 rc2 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:2.6.19:rc3:*:*:*:*:*:* Versions 2.6.19 rc3 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:2.6.19:rc4:*:*:*:*:*:* Versions 2.6.19 rc4 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:2.6.19:rc5:*:*:*:*:*:* Versions 2.6.19 rc5 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:2.6.19:rc6:*:*:*:*:*:* Versions 2.6.19 rc6 Vulnerable ·Linux
Remediation
- Fix · CNA Linux (Linux) Fixed in 4.14.291, 4.19.256, 5.4.211, 5.10.137, 5.15.61, 5.18.18, 5.19.2, 6.0
Red Hat 2 advisories
- RHSA-2024:3138 Released 2024-05-22 · Red Hat rating Moderatekernel security, bug fix, and enhancement update
- Red Hat Enterprise Linux BaseOS (v. 8) bpftool-4.18.0-553.el8_10, kernel-4.18.0-553.el8_10, kernel-abi-stablelists-4.18.0-553.el8_10 +19
- Red Hat Enterprise Linux CRB (v. 8) kernel-tools-libs-devel-4.18.0-553.el8_10
- RHSA-2023:2458 Released 2023-05-09 · Red Hat rating Importantkernel security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-284.11.1.el9_2, kernel-64k-debug-devel-matched-5.14.0-284.11.1.el9_2, kernel-64k-devel-5.14.0-284.11.1.el9_2 +10
- Red Hat Enterprise Linux BaseOS (v. 9) bpftool-7.0.0-284.11.1.el9_2, kernel-5.14.0-284.11.1.el9_2, kernel-64k-5.14.0-284.11.1.el9_2 +29
- Red Hat Enterprise Linux CRB (v. 9) kernel-tools-libs-devel-5.14.0-284.11.1.el9_2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:2458 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2024:3138 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2023:2458 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2024:3138 |
| Red Hat Enterprise Linux CRB (v. 9) | Fixed | RHSA-2023:2458 |
Not affected: 1 product
- Red Hat Enterprise Linux 10
Timeline
- 2026-10-02 Threatist record created from CVE-2022-50126
- 2026-10-03 Alias added: GHSA-w74v-3fr4-63jv
References
Patch 8
- https://git.kernel.org/stable/c/0f61c6dc4b714be9d79cf0782ca02ba01c1b7ac3
- https://git.kernel.org/stable/c/6073389db83b903678a0920554fa19f5bdc51c48
- https://git.kernel.org/stable/c/fa5b65d39332fef7a11ae99cb1f0696012a61527
- https://git.kernel.org/stable/c/f7161d0da975adc234161cd0641d0e484f5ce375
- https://git.kernel.org/stable/c/e62f79827784f56499a50ea2e893c98317b5407b
- https://git.kernel.org/stable/c/731c1662d838fe954c6759e3ee43229b0d928fe4
- https://git.kernel.org/stable/c/ddd896792e1718cb84c96f3e618270589b6886dc
- https://git.kernel.org/stable/c/4a734f0869f970b8a9b65062ea40b09a5da9dba8
More Linux Kernel vulnerabilities
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
- TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
- TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
- TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
- TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
Sources
- CVE-2022-50126 · CVE Program
- CVE-2022-50126 · NVD
- FIRST EPSS
- GHSA-w74v-3fr4-63jv · GitHub Advisory Database · CC BY 4.0
- CVE-2022-50126 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences