CVE-2022-50313

Source
https://nvd.nist.gov/vuln/detail/CVE-2022-50313
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50313.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-50313
Downstream
Published
2025-09-15T15:15:43Z
Modified
2025-09-15T21:00:19Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix order >= MAXORDER warning due to crafted negative isize

As syzbot reported [1], the root cause is that isize field is a signed type, and negative isize is also less than EROFS_BLKSIZ. As a consequence, it's handled as fast symlink unexpectedly.

Let's fall back to the generic path to deal with such unusual i_size.

[1] https://lore.kernel.org/r/000000000000ac8efa05e7feaa1f@google.com

References

Affected packages