In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page() As Dipanjan Das <mail.dipanjan.das@gmail.com> reported, syzkaller found a f2fs bug as below: RIP: 0010:f2fs_new_node_page+0x19ac/0x1fc0 fs/f2fs/node.c:1295 Call Trace: write_all_xattrs fs/f2fs/xattr.c:487 [inline] __f2fs_setxattr+0xe76/0x2e10 fs/f2fs/xattr.c:743 f2fs_setxattr+0x233/0xab0 fs/f2fs/xattr.c:790 f2fs_xattr_generic_set+0x133/0x170 fs/f2fs/xattr.c:86 __vfs_setxattr+0x115/0x180 fs/xattr.c:182 __vfs_setxattr_noperm+0x125/0x5f0 fs/xattr.c:216 __vfs_setxattr_locked+0x1cf/0x260 fs/xattr.c:277 vfs_setxattr+0x13f/0x330 fs/xattr.c:303 setxattr+0x146/0x160 fs/xattr.c:611 path_setxattr+0x1a7/0x1d0 fs/xattr.c:630 __do_sys_lsetxattr fs/xattr.c:653 [inline] __se_sys_lsetxattr fs/xattr.c:649 [inline] __x64_sys_lsetxattr+0xbd/0x150 fs/xattr.c:649 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 NAT entry and nat bitmap can be inconsistent, e.g. one nid is free in nat bitmap, and blkaddr in its NAT entry is not NULL_ADDR, it may trigger BUG_ON() in f2fs_new_node_page(), fix it.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992900 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page()

    As Dipanjan Das <mail.dipanjan.das@gmail.com> reported, syzkaller     found a f2fs bug as below:

    RIP: 0010:f2fs_new_node_page+0x19ac/0x1fc0 fs/f2fs/node.c:1295     Call Trace:
     write_all_xattrs fs/f2fs/xattr.c:487 [inline]
     __f2fs_setxattr+0xe76/0x2e10 fs/f2fs/xattr.c:743      f2fs_setxattr+0x233/0xab0 fs/f2fs/xattr.c:790      f2fs_xattr_generic_set+0x133/0x170 fs/f2fs/xattr.c:86
     __vfs_setxattr+0x115/0x180 fs/xattr.c:182
     __vfs_setxattr_noperm+0x125/0x5f0 fs/xattr.c:216
     __vfs_setxattr_locked+0x1cf/0x260 fs/xattr.c:277      vfs_setxattr+0x13f/0x330 fs/xattr.c:303      setxattr+0x146/0x160 fs/xattr.c:611      path_setxattr+0x1a7/0x1d0 fs/xattr.c:630
     __do_sys_lsetxattr fs/xattr.c:653 [inline]
     __se_sys_lsetxattr fs/xattr.c:649 [inline]
     __x64_sys_lsetxattr+0xbd/0x150 fs/xattr.c:649      do_syscall_x64 arch/x86/entry/common.c:50 [inline]      do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80      entry_SYSCALL_64_after_hwframe+0x46/0xb0

    NAT entry and nat bitmap can be inconsistent, e.g. one nid is free     in nat bitmap, and blkaddr in its NAT entry is not NULL_ADDR, it     may trigger BUG_ON() in f2fs_new_node_page(), fix it.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992417 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page()

    As Dipanjan Das <mail.dipanjan.das@gmail.com> reported, syzkaller     found a f2fs bug as below:

    RIP: 0010:f2fs_new_node_page+0x19ac/0x1fc0 fs/f2fs/node.c:1295     Call Trace:
     write_all_xattrs fs/f2fs/xattr.c:487 [inline]
     __f2fs_setxattr+0xe76/0x2e10 fs/f2fs/xattr.c:743      f2fs_setxattr+0x233/0xab0 fs/f2fs/xattr.c:790      f2fs_xattr_generic_set+0x133/0x170 fs/f2fs/xattr.c:86
     __vfs_setxattr+0x115/0x180 fs/xattr.c:182
     __vfs_setxattr_noperm+0x125/0x5f0 fs/xattr.c:216
     __vfs_setxattr_locked+0x1cf/0x260 fs/xattr.c:277      vfs_setxattr+0x13f/0x330 fs/xattr.c:303      setxattr+0x146/0x160 fs/xattr.c:611      path_setxattr+0x1a7/0x1d0 fs/xattr.c:630
     __do_sys_lsetxattr fs/xattr.c:653 [inline]
     __se_sys_lsetxattr fs/xattr.c:649 [inline]
     __x64_sys_lsetxattr+0xbd/0x150 fs/xattr.c:649      do_syscall_x64 arch/x86/entry/common.c:50 [inline]      do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80      entry_SYSCALL_64_after_hwframe+0x46/0xb0

    NAT entry and nat bitmap can be inconsistent, e.g. one nid is free     in nat bitmap, and blkaddr in its NAT entry is not NULL_ADDR, it     may trigger BUG_ON() in f2fs_new_node_page(), fix it.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992447 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page()

    As Dipanjan Das <mail.dipanjan.das@gmail.com> reported, syzkaller     found a f2fs bug as below:

    RIP: 0010:f2fs_new_node_page+0x19ac/0x1fc0 fs/f2fs/node.c:1295     Call Trace:
     write_all_xattrs fs/f2fs/xattr.c:487 [inline]
     __f2fs_setxattr+0xe76/0x2e10 fs/f2fs/xattr.c:743      f2fs_setxattr+0x233/0xab0 fs/f2fs/xattr.c:790      f2fs_xattr_generic_set+0x133/0x170 fs/f2fs/xattr.c:86
     __vfs_setxattr+0x115/0x180 fs/xattr.c:182
     __vfs_setxattr_noperm+0x125/0x5f0 fs/xattr.c:216
     __vfs_setxattr_locked+0x1cf/0x260 fs/xattr.c:277      vfs_setxattr+0x13f/0x330 fs/xattr.c:303      setxattr+0x146/0x160 fs/xattr.c:611      path_setxattr+0x1a7/0x1d0 fs/xattr.c:630
     __do_sys_lsetxattr fs/xattr.c:653 [inline]
     __se_sys_lsetxattr fs/xattr.c:649 [inline]
     __x64_sys_lsetxattr+0xbd/0x150 fs/xattr.c:649      do_syscall_x64 arch/x86/entry/common.c:50 [inline]      do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80      entry_SYSCALL_64_after_hwframe+0x46/0xb0

    NAT entry and nat bitmap can be inconsistent, e.g. one nid is free     in nat bitmap, and blkaddr in its NAT entry is not NULL_ADDR, it     may trigger BUG_ON() in f2fs_new_node_page(), fix it.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page() As Dipanjan Das <mail.dipanjan.das@gmail.com>     reported, syzkaller found a f2fs bug as below: RIP: 0010:f2fs_new_node_page+0x19ac/0x1fc0     fs/f2fs/node.c:1295 Call Trace: write_all_xattrs fs/f2fs/xattr.c:487 [inline] __f2fs_setxattr+0xe76/0x2e10     fs/f2fs/xattr.c:743 f2fs_setxattr+0x233/0xab0 fs/f2fs/xattr.c:790 f2fs_xattr_generic_set+0x133/0x170     fs/f2fs/xattr.c:86 __vfs_setxattr+0x115/0x180 fs/xattr.c:182 __vfs_setxattr_noperm+0x125/0x5f0     fs/xattr.c:216 __vfs_setxattr_locked+0x1cf/0x260 fs/xattr.c:277 vfs_setxattr+0x13f/0x330 fs/xattr.c:303     setxattr+0x146/0x160 fs/xattr.c:611 path_setxattr+0x1a7/0x1d0 fs/xattr.c:630 __do_sys_lsetxattr     fs/xattr.c:653 [inline] __se_sys_lsetxattr fs/xattr.c:649 [inline] __x64_sys_lsetxattr+0xbd/0x150     fs/xattr.c:649 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0     arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 NAT entry and nat bitmap can be     inconsistent, e.g. one nid is free in nat bitmap, and blkaddr in its NAT entry is not NULL_ADDR, it may     trigger BUG_ON() in f2fs_new_node_page(), fix it. (CVE-2022-50013)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

ID	Name	Product	Family	Severity
281099	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992900)	Nessus	Unity Linux Local Security Checks	medium
280651	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-992417)	Nessus	Unity Linux Local Security Checks	medium
280166	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992447)	Nessus	Unity Linux Local Security Checks	medium
246726	Linux Distros Unpatched Vulnerability : CVE-2022-50013	Nessus	Misc.	medium
151965	Photon OS 4.0: Linux PHSA-2021-4.0-0065	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2022-50013

medium

Tenable Plugins

medium

medium

medium

medium

high