{"id":"DEBIAN-CVE-2022-50334","details":"In the Linux kernel, the following vulnerability has been resolved:  hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param()  Syzkaller reports a null-ptr-deref bug as follows: ====================================================== KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:hugetlbfs_parse_param+0x1dd/0x8e0 fs/hugetlbfs/inode.c:1380 [...] Call Trace:  \u003cTASK\u003e  vfs_parse_fs_param fs/fs_context.c:148 [inline]  vfs_parse_fs_param+0x1f9/0x3c0 fs/fs_context.c:129  vfs_parse_fs_string+0xdb/0x170 fs/fs_context.c:191  generic_parse_monolithic+0x16f/0x1f0 fs/fs_context.c:231  do_new_mount fs/namespace.c:3036 [inline]  path_mount+0x12de/0x1e20 fs/namespace.c:3370  do_mount fs/namespace.c:3383 [inline]  __do_sys_mount fs/namespace.c:3591 [inline]  __se_sys_mount fs/namespace.c:3568 [inline]  __x64_sys_mount+0x27f/0x300 fs/namespace.c:3568  do_syscall_x64 arch/x86/entry/common.c:50 [inline]  do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80  entry_SYSCALL_64_after_hwframe+0x63/0xcd  [...]  \u003c/TASK\u003e ======================================================  According to commit \"vfs: parse: deal with zero length string value\", kernel will set the param-\u003estring to null pointer in vfs_parse_fs_string() if fs string has zero length.  Yet the problem is that, hugetlbfs_parse_param() will dereference the param-\u003estring, without checking whether it is a null pointer.  To be more specific, if hugetlbfs_parse_param() parses an illegal mount parameter, such as \"size=,\", kernel will constructs struct fs_parameter with null pointer in vfs_parse_fs_string(), then passes this struct fs_parameter to hugetlbfs_parse_param(), which triggers the above null-ptr-deref bug.  This patch solves it by adding sanity check on param-\u003estring in hugetlbfs_parse_param().","modified":"2026-09-01T16:05:34.948309221Z","published":"2025-09-15T15:15:45.677Z","upstream":["CVE-2022-50334"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2022-50334"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50334.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50334.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50334.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}