CVE-2022-50401
published 2025-09-18CVE-2022-50401: In the Linux kernel, the following vulnerability has been resolved: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure On error situation…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.44%
36.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure
On error situation `clp->cl_cb_conn.cb_xprt` should not be given
a reference to the xprt otherwise both client cleanup and the
error handling path of the caller call to put it. Better to
delay handing over the reference to a later branch.
[ 72.530665] refcount_t: underflow; use-after-free.
[ 72.531933] WARNING: CPU: 0 PID: 173 at lib/refcount.c:28 refcount_warn_saturate+0xcf/0x120
[ 72.533075] Modules linked in: nfsd(OE) nfsv4(OE) nfsv3(OE) nfs(OE) lockd(OE) compat_nfs_ssc(OE) nfs_acl(OE) rpcsec_gss_krb5(OE) auth_rpcgss(OE) rpcrdma(OE) dns_resolver fscache netfs grace rdma_cm iw_cm ib_cm sunrpc(OE) mlx5_ib mlx5_core mlxfw pci_hyperv_intf ib_uverbs ib_core xt_MASQUERADE nf_conntrack_netlink nft_counter xt_addrtype nft_compat br_netfilter bridge stp llc nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set overlay nf_tables nfnetlink crct10dif_pclmul crc32_pclmul ghash_clmulni_intel xfs serio_raw virtio_net virtio_blk net_failover failover fuse [last unloaded: sunrpc]
[ 72.540389] CPU: 0 PID: 173 Comm: kworker/u16:5 Tainted: G OE 5.15.82-dan #1
[ 72.541511] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-3.module+el8.7.0+1084+97b81f61 04/01/2014
[ 72.542717] Workqueue: nfsd4_callbacks nfsd4_run_cb_work [nfsd]
[ 72.543575] RIP: 0010:refcount_warn_saturate+0xcf/0x120
[ 72.544299] Code: 55 00 0f 0b 5d e9 01 50 98 00 80 3d 75 9e 39 08 00 0f 85 74 ff ff ff 48 c7 c7 e8 d1 60 8e c6 05 61 9e 39 08 01 e8 f6 51 55 00 0b 5d e9 d9 4f 98 00 80 3d 4b 9e 39 08 00 0f 85 4c ff ff ff 48
[ 72.546666] RSP: 0018:ffffb3f841157cf0 EFLAGS: 00010286
[ 72.547393] RAX: 0000000000000026 RBX: ffff89ac6231d478 RCX: 0000000000000000
[ 72.548324] RDX: ffff89adb7c2c2c0 RSI: ffff89adb7c205c0 RDI: ffff89adb7c205c0
[ 72.549271] RBP: ffffb3f841157cf0 R08: 0000000000000000 R09: c0000000ffef
Affected
37 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.4-1 (bookworm) | linux 6.1.4-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 0c4fb76c4e711d9e4e70ddc6732310a17076175d < 15fc60aa5bdcf6d5f93000d3d00579fc67632ee0 | 15fc60aa5bdcf6d5f93000d3d00579fc67632ee0 |
| linux | linux | >= 22c721560ef24003bcb9c3d9c358841dcfa4e212 < 9b4ae8c42d2ff09ed7c5832ccce5684c55e5ed23 | 9b4ae8c42d2ff09ed7c5832ccce5684c55e5ed23 |
| linux | linux | >= 4.14.186 < 4.14.303 | 4.14.303 |
| linux | linux | >= 4.19.130 < 4.19.270 | 4.19.270 |
| linux | linux | >= 4.4.229 < 4.5 | 4.5 |
| linux | linux | >= 4.9.229 < 4.9.337 | 4.9.337 |
| linux | linux | >= 5.4.49 < 5.4.229 | 5.4.229 |
| linux | linux | >= 5.7.6 < 5.8 | 5.8 |
| linux | linux | >= 69151594c72a1748cf93ae5b5fa68d5084253dce < 707bcca9616002d204091ca7c4d1d91151104332 | 707bcca9616002d204091ca7c4d1d91151104332 |
| linux | linux | >= a4abc6b12eb1f7a533c2e7484cfa555454ff0977 < c1207219a4bfa50121c9345d5d165470d0a82531 | c1207219a4bfa50121c9345d5d165470d0a82531 |
| linux | linux | >= a4abc6b12eb1f7a533c2e7484cfa555454ff0977 < a472f069ced8601979f53c13c0cf20236074ed46 | a472f069ced8601979f53c13c0cf20236074ed46 |
| linux | linux | >= a4abc6b12eb1f7a533c2e7484cfa555454ff0977 < e2f9f03e4537f3fcc8fd2bdd3248530c3477a371 | e2f9f03e4537f3fcc8fd2bdd3248530c3477a371 |
| linux | linux | >= a4abc6b12eb1f7a533c2e7484cfa555454ff0977 < d843ebd860c58a38e45527e8ec6516059f4c97f3 | d843ebd860c58a38e45527e8ec6516059f4c97f3 |
| linux | linux | >= a4abc6b12eb1f7a533c2e7484cfa555454ff0977 < 3bc8edc98bd43540dbe648e4ef91f443d6d20a24 | 3bc8edc98bd43540dbe648e4ef91f443d6d20a24 |
| linux | linux | >= e8cac2e3067e8587f8271c2177cc5ca924a61b54 < fddac3b4578d302ac9e51e7f03a9aae6254ae2a3 | fddac3b4578d302ac9e51e7f03a9aae6254ae2a3 |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 4.14.186 < 4.14.303 | 4.14.303 |
| linux | linux_kernel | >= 4.19.130 < 4.19.270 | 4.19.270 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (AWS) vulnerabilities
vendor_ubuntu·2026-09-18·CVSS 7.8
CVE-2026-53224 [HIGH] Linux kernel (AWS) vulnerabilities
Title: Linux kernel (AWS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- NVIDIA Tegra memory controller driver;
- File systems infrastructure;
- Network file system (NFS) server daemon;
- OCFS2 file system;
- B.A.T.M.A.N. meshing protocol;
- Netfilter;
- SCTP protocol;
(CVE-2022-50401, CVE-2026-43071, CVE-2026-52914, CVE-2026-53002,
CVE-2026-53043, CVE-2026-53045, CVE-2026-53224, CVE-2026-53309)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-09-04·CVSS 7.8
CVE-2026-53045 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- NVIDIA Tegra memory controller driver;
- File systems infrastructure;
- Network file system (NFS) server daemon;
- OCFS2 file system;
- B.A.T.M.A.N. meshing protocol;
- Netfilter;
- SCTP protocol;
(CVE-2022-50401, CVE-2026-43071, CVE-2026-52914, CVE-2026-53002,
CVE-2026-53043, CVE-2026-53045, CVE-2026-53224, CVE-2026-53309)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been g
Red Hat
kernel: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure
vendor_redhat·2025-09-18·CVSS 7.8
CVE-2022-50401 [HIGH] CWE-415 kernel: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure
kernel: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure
In the Linux kernel, the following vulnerability has been resolved:
nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure
On error situation `clp->cl_cb_conn.cb_xprt` should not be given
a reference to the xprt otherwise both client cleanup and the
error handling path of the caller call to put it. Better to
delay handing over the reference to a later branch.
[ 72.530665] refcount_t: underflow; use-after-free.
[ 72.531933] WARNING: CPU: 0 PID: 173 at lib/refcount.c:28 refcount_warn_saturate+0xcf/0x120
[ 72.533075] Modules linked in: nfsd(OE) nfsv4(OE) nfsv3(OE) nfs(OE) lockd(OE) compat_nfs_ssc(OE) nfs_acl(OE) rpcsec_gss_krb5(OE) auth_rpcgss(OE) rpcrdma(OE) dns_resolver fscache netfs grace rdma_cm iw_cm
Debian
CVE-2022-50401: linux - In the Linux kernel, the following vulnerability has been resolved: nfsd: under...
vendor_debian·2022·CVSS 7.8
CVE-2022-50401 [HIGH] CVE-2022-50401: linux - In the Linux kernel, the following vulnerability has been resolved: nfsd: under...
In the Linux kernel, the following vulnerability has been resolved: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure On error situation `clp->cl_cb_conn.cb_xprt` should not be given a reference to the xprt otherwise both client cleanup and the error handling path of the caller call to put it. Better to delay handing over the reference to a later branch. [ 72.530665] refcount_t: underflow; use-after-free. [ 72.531933] WARNING: CPU: 0 PID: 173 at lib/refcount.c:28 refcount_warn_saturate+0xcf/0x120 [ 72.533075] Modules linked in: nfsd(OE) nfsv4(OE) nfsv3(OE) nfs(OE) lockd(OE) compat_nfs_ssc(OE) nfs_acl(OE) rpcsec_gss_krb5(OE) auth_rpcgss(OE) rpcrdma(OE) dns_resolver fscache netfs grace rdma_cm iw_cm ib_cm sunrpc(OE) mlx5_ib mlx5_core mlxfw pci_hyperv_intf ib_uverbs ib_core x
GHSA
GHSA-3854-9jq2-j856: In the Linux kernel, the following vulnerability has been resolved:
nfsd: under NFSv4
ghsa_unreviewed·2025-09-18
CVE-2022-50401 [HIGH] CWE-415 GHSA-3854-9jq2-j856: In the Linux kernel, the following vulnerability has been resolved:
nfsd: under NFSv4
In the Linux kernel, the following vulnerability has been resolved:
nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure
On error situation `clp->cl_cb_conn.cb_xprt` should not be given
a reference to the xprt otherwise both client cleanup and the
error handling path of the caller call to put it. Better to
delay handing over the reference to a later branch.
[ 72.530665] refcount_t: underflow; use-after-free.
[ 72.531933] WARNING: CPU: 0 PID: 173 at lib/refcount.c:28 refcount_warn_saturate+0xcf/0x120
[ 72.533075] Modules linked in: nfsd(OE) nfsv4(OE) nfsv3(OE) nfs(OE) lockd(OE) compat_nfs_ssc(OE) nfs_acl(OE) rpcsec_gss_krb5(OE) auth_rpcgss(OE) rpcrdma(OE) dns_resolver fscache netfs grace rdma_cm iw_cm ib_cm sunrpc(OE) mlx5_ib mlx5_core mlxfw pci_hyperv_intf ib_uverbs ib_cor
OSV
CVE-2022-50401: In the Linux kernel, the following vulnerability has been resolved: nfsd: under NFSv4
osv·2025-09-18·CVSS 7.8
CVE-2022-50401 [HIGH] CVE-2022-50401: In the Linux kernel, the following vulnerability has been resolved: nfsd: under NFSv4
In the Linux kernel, the following vulnerability has been resolved: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure On error situation `clp->cl_cb_conn.cb_xprt` should not be given a reference to the xprt otherwise both client cleanup and the error handling path of the caller call to put it. Better to delay handing over the reference to a later branch. [ 72.530665] refcount_t: underflow; use-after-free. [ 72.531933] WARNING: CPU: 0 PID: 173 at lib/refcount.c:28 refcount_warn_saturate+0xcf/0x120 [ 72.533075] Modules linked in: nfsd(OE) nfsv4(OE) nfsv3(OE) nfs(OE) lockd(OE) compat_nfs_ssc(OE) nfs_acl(OE) rpcsec_gss_krb5(OE) auth_rpcgss(OE) rpcrdma(OE) dns_resolver fscache netfs grace rdma_cm iw_cm ib_cm sunrpc(OE) mlx5_ib mlx5_core mlxfw pci_hyperv_intf ib_uverbs ib_core x
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/15fc60aa5bdcf6d5f93000d3d00579fc67632ee0https://git.kernel.org/stable/c/3bc8edc98bd43540dbe648e4ef91f443d6d20a24https://git.kernel.org/stable/c/707bcca9616002d204091ca7c4d1d91151104332https://git.kernel.org/stable/c/9b4ae8c42d2ff09ed7c5832ccce5684c55e5ed23https://git.kernel.org/stable/c/a472f069ced8601979f53c13c0cf20236074ed46https://git.kernel.org/stable/c/c1207219a4bfa50121c9345d5d165470d0a82531https://git.kernel.org/stable/c/d843ebd860c58a38e45527e8ec6516059f4c97f3https://git.kernel.org/stable/c/e2f9f03e4537f3fcc8fd2bdd3248530c3477a371https://git.kernel.org/stable/c/fddac3b4578d302ac9e51e7f03a9aae6254ae2a3
2025-09-18
Published