CVE-2022-50410
published 2025-09-18CVE-2022-50410: In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READ Since before the git era, NFSD has…
PriorityP341high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.17%
6.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Protect against send buffer overflow in NFSv2 READ
Since before the git era, NFSD has conserved the number of pages
held by each nfsd thread by combining the RPC receive and send
buffers into a single array of pages. This works because there are
no cases where an operation needs a large RPC Call message and a
large RPC Reply at the same time.
Once an RPC Call has been received, svc_process() updates
svc_rqst::rq_res to describe the part of rq_pages that can be
used for constructing the Reply. This means that the send buffer
(rq_res) shrinks when the received RPC record containing the RPC
Call is large.
A client can force this shrinkage on TCP by sending a correctly-
formed RPC Call header contained in an RPC record that is
excessively large. The full maximum payload size cannot be
constructed in that case.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.3-1 (bookworm) | linux 6.0.3-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 4452435948424e5322c2a2fefbdc2cf3732cc45d < 2007867c5874134f2271eb276398208070049dd3 | 2007867c5874134f2271eb276398208070049dd3 |
| linux | linux | >= 4452435948424e5322c2a2fefbdc2cf3732cc45d < 2be9331ca6061bc6ea32247266f45b8b21030244 | 2be9331ca6061bc6ea32247266f45b8b21030244 |
| linux | linux | >= 4452435948424e5322c2a2fefbdc2cf3732cc45d < ea4c3eee0fd72fcedaa238556044825639cd3607 | ea4c3eee0fd72fcedaa238556044825639cd3607 |
| linux | linux | >= 4452435948424e5322c2a2fefbdc2cf3732cc45d < 1868332032eccbab8c1878a0d918193058c0a905 | 1868332032eccbab8c1878a0d918193058c0a905 |
| linux | linux | >= 4452435948424e5322c2a2fefbdc2cf3732cc45d < 401bc1f90874280a80b93f23be33a0e7e2d1f912 | 401bc1f90874280a80b93f23be33a0e7e2d1f912 |
| linux | linux_kernel | < 5.10.220 | 5.10.220 |
| linux | linux_kernel | >= 0 < 5.10.221-1 | 5.10.221-1 |
| linux | linux_kernel | >= 0 < 6.0.3-1 | 6.0.3-1 |
| linux | linux_kernel | >= 0 < 6.0.3-1 | 6.0.3-1 |
| linux | linux_kernel | >= 0 < 6.0.3-1 | 6.0.3-1 |
| linux | linux_kernel | >= 5.11 < 5.15.75 | 5.15.75 |
| linux | linux_kernel | >= 5.16 < 5.19.17 | 5.19.17 |
| linux | linux_kernel | >= 6.0 < 6.0.3 | 6.0.3 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2022-50410: In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READ Since before the git era,
osv·2025-09-18·CVSS 7.8
CVE-2022-50410 [HIGH] CVE-2022-50410: In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READ Since before the git era,
In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READ Since before the git era, NFSD has conserved the number of pages held by each nfsd thread by combining the RPC receive and send buffers into a single array of pages. This works because there are no cases where an operation needs a large RPC Call message and a large RPC Reply at the same time. Once an RPC Call has been received, svc_process() updates svc_rqst::rq_res to describe the part of rq_pages that can be used for constructing the Reply. This means that the send buffer (rq_res) shrinks when the received RPC record containing the RPC Call is large. A client can force this shrinkage on TCP by sending a correctly- formed RPC Call header contained in an RPC record t
GHSA
GHSA-fcpw-f2ff-x55p: In the Linux kernel, the following vulnerability has been resolved:
NFSD: Protect against send buffer overflow in NFSv2 READ
Since before the git er
ghsa_unreviewed·2025-09-18
CVE-2022-50410 [HIGH] CWE-787 GHSA-fcpw-f2ff-x55p: In the Linux kernel, the following vulnerability has been resolved:
NFSD: Protect against send buffer overflow in NFSv2 READ
Since before the git er
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Protect against send buffer overflow in NFSv2 READ
Since before the git era, NFSD has conserved the number of pages
held by each nfsd thread by combining the RPC receive and send
buffers into a single array of pages. This works because there are
no cases where an operation needs a large RPC Call message and a
large RPC Reply at the same time.
Once an RPC Call has been received, svc_process() updates
svc_rqst::rq_res to describe the part of rq_pages that can be
used for constructing the Reply. This means that the send buffer
(rq_res) shrinks when the received RPC record containing the RPC
Call is large.
A client can force this shrinkage on TCP by sending a correctly-
formed RPC Call header contained in an RPC reco
Red Hat
kernel: NFSD: Protect against send buffer overflow in NFSv2 READ
vendor_redhat·2025-09-18·CVSS 7.8
CVE-2022-50410 [HIGH] CWE-787 kernel: NFSD: Protect against send buffer overflow in NFSv2 READ
kernel: NFSD: Protect against send buffer overflow in NFSv2 READ
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Protect against send buffer overflow in NFSv2 READ
Since before the git era, NFSD has conserved the number of pages
held by each nfsd thread by combining the RPC receive and send
buffers into a single array of pages. This works because there are
no cases where an operation needs a large RPC Call message and a
large RPC Reply at the same time.
Once an RPC Call has been received, svc_process() updates
svc_rqst::rq_res to describe the part of rq_pages that can be
used for constructing the Reply. This means that the send buffer
(rq_res) shrinks when the received RPC record containing the RPC
Call is large.
A client can force this shrinkage on TCP by sendin
Debian
CVE-2022-50410: linux - In the Linux kernel, the following vulnerability has been resolved: NFSD: Prote...
vendor_debian·2022·CVSS 7.8
CVE-2022-50410 [HIGH] CVE-2022-50410: linux - In the Linux kernel, the following vulnerability has been resolved: NFSD: Prote...
In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READ Since before the git era, NFSD has conserved the number of pages held by each nfsd thread by combining the RPC receive and send buffers into a single array of pages. This works because there are no cases where an operation needs a large RPC Call message and a large RPC Reply at the same time. Once an RPC Call has been received, svc_process() updates svc_rqst::rq_res to describe the part of rq_pages that can be used for constructing the Reply. This means that the send buffer (rq_res) shrinks when the received RPC record containing the RPC Call is large. A client can force this shrinkage on TCP by sending a correctly- formed RPC Call header contained in an RPC record t
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/1868332032eccbab8c1878a0d918193058c0a905https://git.kernel.org/stable/c/2007867c5874134f2271eb276398208070049dd3https://git.kernel.org/stable/c/2be9331ca6061bc6ea32247266f45b8b21030244https://git.kernel.org/stable/c/401bc1f90874280a80b93f23be33a0e7e2d1f912https://git.kernel.org/stable/c/ea4c3eee0fd72fcedaa238556044825639cd3607
2025-09-18
Published