Use-After-Free Vulnerability in Linux Kernel's JBD2 Component

CVE-2022-50328

What is CVE-2022-50328?

A vulnerability exists in the Linux kernel within the JBD2 subsystem that may lead to a use-after-free condition. Specifically, in the function 'jbd2_fc_wait_bufs', the code improperly uses the 'bh' variable after it has been released. This oversight could potentially expose a system to security risks if the buffer head reference count is not handled correctly. Implementing a check on the buffer's uptodate status before modifying the reference count is essential to mitigate this risk.

References