linux — security advisory

{
  "id": "5ae99caf51d1202b573b95f8f715515ac03687a3a39c23ad4ced4a8bce9ec0f2",
  "url": "https://osv.dev/vulnerability/DEBIAN-CVE-2022-49880",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "DEBIAN-CVE-2022-49880",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: ext4: fix warning in 'ext4_da_release_space' Syzkaller report issue as follows: EXT4-fs (loop0): Free/Dirty block details EXT4-fs (loop0): free_blocks=0 EXT4-fs (loop0): dirty_blocks=0 EXT4-fs (loop0): Block reservation details EXT4-fs (loop0): i_reserved_data_blocks=0 EXT4-fs warning (device loop0): ext4_da_release_space:1527: ext4_da_release_space: ino 18, to_free 1 with only 0 reserved data blocks ------------[ cut here ]------------ WARNING: CPU: 0 PID: 92 at fs/ext4/inode.c:1528 ext4_da_release_space+0x25e/0x370 fs/ext4/inode.c:1524 Modules linked in: CPU: 0 PID: 92 Comm: kworker/u4:4 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Workqueue: writeback wb_workfn (flush-7:0) RIP: 0010:ext4_da_release_space+0x25e/0x370 fs/ext4/inode.c:1528 RSP: 0018:ffffc900015f6c90 EFLAGS: 00010296 RAX: 42215896cd52ea00 RBX: 0000000000000000 RCX: 42215896cd52ea00 RDX: 0000000000000000 RSI: 0000000080000001 RDI: 0000000000000000 RBP: 1ffff1100e907d96 R08: ffffffff816aa79d R09: fffff520002bece5 R10: fffff520002bece5 R11: 1ffff920002bece4 R12: ffff888021fd2000 R13: ffff88807483ecb0 R14: 0000000000000001 R15: ffff88807483e740 FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005555569ba628 CR3: 000000000c88e000 CR4: 00000000003506f0 DR0: 0000000000000000",
    "evidence": "osv:DEBIAN-CVE-2022-49880",
    "products": [
      {
        "name": {
          "value": "linux",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.0.8-1",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "linux",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.0.8-1",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "linux",
          "evidence": "/affected/2/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.0.8-1",
            "evidence": "/affected/2/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "DEBIAN-CVE-2022-49880",
      "aliases": [
        "DEBIAN-CVE-2022-49880"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "6.0.8-1"
                }
              ]
            }
          ],
          "package": {
            "name": "linux",
            "purl": "pkg:deb/debian/linux?arch=source&distro=bookworm",
            "ecosystem": "Debian:12"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49880.json"
          },
          "ecosystem_specific": {
            "urgency": "not yet assigned"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "6.0.8-1"
                }
              ]
            }
          ],
          "package": {
            "name": "linux",
            "purl": "pkg:deb/debian/linux?arch=source&distro=trixie",
            "ecosystem": "Debian:13"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49880.json"
          },
          "ecosystem_specific": {
            "urgency": "not yet assigned"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "6.0.8-1"
                }
              ]
            }
          ],
          "package": {
            "name": "linux",
            "purl": "pkg:deb/debian/linux?arch=source&distro=forky",
            "ecosystem": "Debian:14"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49880.json"
          },
          "ecosystem_specific": {
            "urgency": "not yet assigned"
          }
        }
      ],
      "modified": "2026-10-15T08:03:03.041795885Z",
      "provider": "osv",
      "upstream": [
        "CVE-2022-49880"
      ],
      "references": [
        "https://security-tracker.debian.org/tracker/CVE-2022-49880"
      ]
    },
    "related_cves": [
      {
        "value": "CVE-2022-49880",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 324985,
  "published_at": "2025-05-01T15:16:12.96+00:00"
}