https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 13:30:47 +0000 https://cve.radiocsirt.org/vuln/cve-2022-49834 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>nilfs2: fix use-after-free bug of ns_writer on remount</p> <p>If a nilfs2 filesystem is downgraded to read-only due to metadata corruption on disk and is remounted read/write, or if emergency read-only remount is performed, detaching a log writer and synchronizing the filesystem can be done at the same time.</p> <p>In these cases, use-after-free of the log writer (hereinafter nilfs-&gt;ns_writer) can happen as shown in the scenario below:</p> <p>Task1 Task2 -------------------------------- ------------------------------ nilfs_construct_segment nilfs_segctor_sync init_wait init_waitqueue_entry add_wait_queue schedule nilfs_remount (R/W remount case) nilfs_attach_log_writer nilfs_detach_log_writer nilfs_segctor_destroy kfree finish_wait _raw_spin_lock_irqsave __raw_spin_lock_irqsave do_raw_spin_lock debug_spin_lock_before &lt;-- use-after-free</p> <p>While Task1 is sleeping, nilfs-&gt;ns_writer is freed by Task2. After Task1 waked up, Task1 accesses nilfs-&gt;ns_writer which is already freed. This scenario diagram is based on the Shigeru Yoshida&#39;s post [1].</p> <p>This patch fixes the issue by not detaching nilfs-&gt;ns_writer on remount so that this UAF race doesn&#39;t happen.…</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>nilfs2: fix use-after-free bug of ns_writer on remount</p> <p>If a nilfs2 filesystem is downgraded to read-only due to metadata corruption on disk and is remounted read/write, or if emergency read-only remount is performed, detaching a log writer and synchronizing the filesystem can be done at the same time.</p> <p>In these cases, use-after-free of the log writer (hereinafter nilfs-&gt;ns_writer) can happen as shown in the scenario below:</p> <p>Task1 Task2 -------------------------------- ------------------------------ nilfs_construct_segment nilfs_segctor_sync init_wait init_waitqueue_entry add_wait_queue schedule nilfs_remount (R/W remount case) nilfs_attach_log_writer nilfs_detach_log_writer nilfs_segctor_destroy kfree finish_wait _raw_spin_lock_irqsave __raw_spin_lock_irqsave do_raw_spin_lock debug_spin_lock_before &lt;-- use-after-free</p> <p>While Task1 is sleeping, nilfs-&gt;ns_writer is freed by Task2. After Task1 waked up, Task1 accesses nilfs-&gt;ns_writer which is already freed. This scenario diagram is based on the Shigeru Yoshida&#39;s post [1].</p> <p>This patch fixes the issue by not detaching nilfs-&gt;ns_writer on remount so that this UAF race doesn&#39;t happen.…</p> https://cve.radiocsirt.org/vuln/cve-2022-49834