{"cve":"CVE-2022-49274","nvd":{"published":"2025-02-26T07:01:04.280","modified":"2026-08-04T10:17:42.290","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix crash when mount with quota enabled\n\nThere is a reported crash when mounting ocfs2 with quota enabled.\n\n  RIP: 0010:ocfs2_qinfo_lock_res_init+0x44/0x50 [ocfs2]\n  Call Trace:\n    ocfs2_local_read_info+0xb9/0x6f0 [ocfs2]\n    dquot_load_quota_sb+0x216/0x470\n    dquot_load_quota_inode+0x85/0x100\n    ocfs2_enable_quotas+0xa0/0x1c0 [ocfs2]\n    ocfs2_fill_super.cold+0xc8/0x1bf [ocfs2]\n    mount_bdev+0x185/0x1b0\n    legacy_get_tree+0x27/0x40\n    vfs_get_tree+0x25/0xb0\n    path_mount+0x465/0xac0\n    __x64_sys_mount+0x103/0x140\n\nIt is caused by when initializing dqi_gqlock, the corresponding dqi_type\nand dqi_sb are not properly initialized.\n\nThis issue is introduced by commit 6c85c2c72819, which wants to avoid\naccessing uninitialized variables in error cases.  So make global quota\ninfo properly initialized.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":["CWE-908"],"references":["https://git.kernel.org/stable/c/01931e1c4e3de5d777253acae64c0e8fd071a1dd","https://git.kernel.org/stable/c/7c5312fdb1dcfdc1951b018669af88d5d6420b31","https://git.kernel.org/stable/c/de19433423c7bedabbd4f9a25f7dbc62c5e78921","https://git.kernel.org/stable/c/eda31f77317647b9fbf889779ee1fb6907651865"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T21:59:48.811064707+00:00"},"epss":{"cve":"CVE-2022-49274","score":0.00281,"percentile":0.20613,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}