Is CVE-2022-50273 in the CISA KEV catalog?

No. CVE-2022-50273 is not currently on the CISA Known Exploited Vulnerabilities list.

What is the CVSS severity of CVE-2022-50273?

CVE-2022-50273 has a CVSS v3 base score of 5.5 (MEDIUM).

What is the EPSS score for CVE-2022-50273?

CVE-2022-50273 has an EPSS score of 0.14% (4th percentile), estimating the probability of exploitation in the next 30 days.

How do I fix CVE-2022-50273?

Upgrade linux on debian 11 to 5.10.158-1 or later.

CVE & CISA-KEV Catalog

CVE-2022-50273

MEDIUM

5.5

CVSS v3

NVD

Description

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on destination blkaddr during recovery As Wenqing Liu reported in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216456 loop5: detected capacity change from 0 to 131072 F2FS-fs (loop5): recover_inode: ino = 6, name = hln, inline = 1 F2FS-fs (loop5): recover_data: ino = 6 (i_size: recover) err = 0 F2FS-fs (loop5): recover_inode: ino = 6, name = hln, inline = 1 F2FS-fs (loop5): recover_data: ino = 6 (i_size: recover) err = 0 F2FS-fs (loop5): recover_inode: ino = 6, name = hln, inline = 1 F2FS-fs (loop5): recover_data: ino = 6 (i_size: recover) err = 0 F2FS-fs (loop5): Bitmap was wrongly set, blk:5634 ------------[ cut here ]------------ WARNING: CPU: 3 PID: 1013 at fs/f2fs/segment.c:2198 RIP: 0010:update_sit_entry+0xa55/0x10b0 [f2fs] Call Trace: <TASK> f2fs_do_replace_block+0xa98/0x1890 [f2fs] f2fs_replace_block+0xeb/0x180 [f2fs] recover_data+0x1a69/0x6ae0 [f2fs] f2fs_recover_fsync_data+0x120d/0x1fc0 [f2fs] f2fs_fill_super+0x4665/0x61e0 [f2fs] mount_bdev+0x2cf/0x3b0 legacy_get_tree+0xed/0x1d0 vfs_get_tree+0x81/0x2b0 path_mount+0x47e/0x19d0 do_mount+0xce/0xf0 __x64_sys_mount+0x12c/0x1a0 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd If we enable CONFIG_F2FS_CHECK_FS config, it will trigger a kernel panic instead of warning. The root cause is: in fuzzed image, SIT table is inconsistent with inode mapping table, result in triggering such warning during SIT table update. This patch introduces a new flag DATA_GENERIC_ENHANCE_UPDATE, w/ this flag, data block recovery flow can check destination blkaddr's validation in SIT table, and skip f2fs_replace_block() to avoid inconsistent status.

How to fix

Remediation Available

linuxDebian

Fixed in:5.10.158-1CVE-2022-50273

Fixed in:6.0.3-1CVE-2022-50273

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorLocal

Attack ComplexityLow

Privileges RequiredLow

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityNone

IntegrityNone

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploit Intelligence

0.14%probability of exploitation in 30 days

4thpercentile

Low risk: more likely to be exploited than 4% of all known CVEs.

References

Patch6

Embed a live status badge for CVE-2022-50273

Markdown

[![CVE-2022-50273](https://tridentstack.com/cve/badge/CVE-2022-50273.svg)](https://tridentstack.com/cve/CVE-2022-50273)

HTML

<a href="https://tridentstack.com/cve/CVE-2022-50273"><img src="https://tridentstack.com/cve/badge/CVE-2022-50273.svg" alt="CVE-2022-50273"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2025-12-03.