CVE-2022-50072

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2022-50072", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-06-18T10:57:27.407Z", "datePublished": "2025-06-18T11:02:16.658Z", "dateUpdated": "2026-08-05T08:57:19.571Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:57:19.571Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4/pnfs: Fix a use-after-free bug in open\n\nIf someone cancels the open RPC call, then we must not try to free\neither the open slot or the layoutget operation arguments, since they\nare likely still in use by the hung RPC call."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - This is NFSv4 client code (fs/nfs/nfs4proc.c) reached via local open() on a pNFS mount; the UAF is triggered when a local process cancels the killable RPC wait, not by unsolicited remote packet processing.\nAC:L - An attacker who can open a file on a pNFS (filelayout/flexfiles) mount controls both sides: start OPEN+LAYOUTGET and send a fatal signal during the in-flight RPC, which is reliably achievable with normal network latency or a slow server.\nPR:L - Any unprivileged user with access to an already-mounted NFSv4/pNFS filesystem can open files and interrupt the syscall; no root or init-namespace capabilities are required.\nUI:N - The attacker opens and cancels their own NFS file operation; no separate victim action is required once a pNFS mount is available.\nS:U - This is a same-host kernel memory-safety bug in the NFS client; impact stays within the local kernel's security authority with no VM/IOMMU boundary crossing.\nC:H - The bug frees nfs4_layoutget (including layout reply pages) while the outstanding OPEN compound still references them via lg_args/lg_res, yielding a classic UAF that can disclose kernel memory.\nI:H - Use-after-free of the layoutget object and its XDR reply pages while the RPC layer may still write into them enables heap corruption and control-flow hijacking primitives.\nA:H - The UAF of in-use RPC/layoutget state can cause kernel oops/panic when the hung RPC completes and touches the freed structures."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfs/nfs4proc.c"], "versions": [{"version": "6b3fc1496e7227cd6a39a80bbfb7588ef7c7a010", "lessThan": "0fffb46ff3d5ed4668aca96441ec7a25b793bd6f", "status": "affected", "versionType": "git"}, {"version": "a2b3be930e79cc5d9d829f158e31172b2043f0cd", "lessThan": "f7ee3b772d9de87387a725caa04bc041ac7fe5ec", "status": "affected", "versionType": "git"}, {"version": "0ee5b9644f06b4d3cdcd9544f43f63312e425a4c", "lessThan": "76ffd2042438769298f34b76102b40dea89de616", "status": "affected", "versionType": "git"}, {"version": "d4c2a041ed3ba114502d5ed6ace5b1a48d637a8e", "lessThan": "a4cf3dadd1fa43609f7c6570c9116b0e0a9923d1", "status": "affected", "versionType": "git"}, {"version": "6949493884fe88500de4af182588e071cf1544ee", "lessThan": "b03d1117e9be7c7da60e466eaf9beed85c5916c8", "status": "affected", "versionType": "git"}, {"version": "6949493884fe88500de4af182588e071cf1544ee", "lessThan": "2135e5d56278ffdb1c2e6d325dc6b87f669b9dac", "status": "affected", "versionType": "git"}, {"version": "08d7a26d115cc7892668baa9750f64bd8baca29b", "status": "affected", "versionType": "git"}, {"version": "ea759ae0a9ae5acee677d722129710ac89cc59c1", "status": "affected", "versionType": "git"}, {"version": "4.19.247", "lessThan": "4.19.256", "status": "affected", "versionType": "semver"}, {"version": "5.4.198", "lessThan": "5.4.211", "status": "affected", "versionType": "semver"}, {"version": "5.10.122", "lessThan": "5.10.138", "status": "affected", "versionType": "semver"}, {"version": "5.15.47", "lessThan": "5.15.63", "status": "affected", "versionType": "semver"}, {"version": "5.17.15", "lessThan": "5.18", "status": "affected", "versionType": "semver"}, {"version": "5.18.4", "lessThan": "5.19", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfs/nfs4proc.c"], "versions": [{"version": "5.19", "status": "affected"}, {"version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.256", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.211", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.138", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.63", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.19.4", "lessThanOrEqual": "5.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.247", "versionEndExcluding": "4.19.256"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.198", "versionEndExcluding": "5.4.211"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.122", "versionEndExcluding": "5.10.138"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.47", "versionEndExcluding": "5.15.63"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "5.19.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17.15"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18.4"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0fffb46ff3d5ed4668aca96441ec7a25b793bd6f"}, {"url": "https://git.kernel.org/stable/c/f7ee3b772d9de87387a725caa04bc041ac7fe5ec"}, {"url": "https://git.kernel.org/stable/c/76ffd2042438769298f34b76102b40dea89de616"}, {"url": "https://git.kernel.org/stable/c/a4cf3dadd1fa43609f7c6570c9116b0e0a9923d1"}, {"url": "https://git.kernel.org/stable/c/b03d1117e9be7c7da60e466eaf9beed85c5916c8"}, {"url": "https://git.kernel.org/stable/c/2135e5d56278ffdb1c2e6d325dc6b87f669b9dac"}], "title": "NFSv4/pnfs: Fix a use-after-free bug in open", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/nfs/nfs4proc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0fffb46ff3d5ed4668aca96441ec7a25b793bd6f", "status": "affected", "version": "6b3fc1496e7227cd6a39a80bbfb7588ef7c7a010", "versionType": "git"}, {"lessThan": "f7ee3b772d9de87387a725caa04bc041ac7fe5ec", "status": "affected", "version": "a2b3be930e79cc5d9d829f158e31172b2043f0cd", "versionType": "git"}, {"lessThan": "76ffd2042438769298f34b76102b40dea89de616", "status": "affected", "version": "0ee5b9644f06b4d3cdcd9544f43f63312e425a4c", "versionType": "git"}, {"lessThan": "a4cf3dadd1fa43609f7c6570c9116b0e0a9923d1", "status": "affected", "version": "d4c2a041ed3ba114502d5ed6ace5b1a48d637a8e", "versionType": "git"}, {"lessThan": "b03d1117e9be7c7da60e466eaf9beed85c5916c8", "status": "affected", "version": "6949493884fe88500de4af182588e071cf1544ee", "versionType": "git"}, {"lessThan": "2135e5d56278ffdb1c2e6d325dc6b87f669b9dac", "status": "affected", "version": "6949493884fe88500de4af182588e071cf1544ee", "versionType": "git"}, {"status": "affected", "version": "08d7a26d115cc7892668baa9750f64bd8baca29b", "versionType": "git"}, {"status": "affected", "version": "ea759ae0a9ae5acee677d722129710ac89cc59c1", "versionType": "git"}, {"lessThan": "4.19.256", "status": "affected", "version": "4.19.247", "versionType": "semver"}, {"lessThan": "5.4.211", "status": "affected", "version": "5.4.198", "versionType": "semver"}, {"lessThan": "5.10.138", "status": "affected", "version": "5.10.122", "versionType": "semver"}, {"lessThan": "5.15.63", "status": "affected", "version": "5.15.47", "versionType": "semver"}, {"lessThan": "5.18", "status": "affected", "version": "5.17.15", "versionType": "semver"}, {"lessThan": "5.19", "status": "affected", "version": "5.18.4", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/nfs/nfs4proc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.19"}, {"lessThan": "5.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.256", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.211", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.138", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.63", "versionType": "semver"}, {"lessThanOrEqual": "5.19.*", "status": "unaffected", "version": "5.19.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A9D0E403-93CD-4ABF-8718-D5DAC1A93751", "versionEndExcluding": "4.19.256", "versionStartIncluding": "4.19.247", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4C0BEDE1-12B6-4D8B-8C46-E1E2B8DAD97D", "versionEndExcluding": "5.4.211", "versionStartIncluding": "5.4.198", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E1AA15B2-8A46-4621-BF63-41277E789CD7", "versionEndExcluding": "5.10.138", "versionStartIncluding": "5.10.122", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "60A70FAB-2AB6-4E33-87C0-A0FD014B35A3", "versionEndExcluding": "5.15.63", "versionStartIncluding": "5.15.47", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5BF6ED63-C6AF-4B5E-9814-C77A3C45349D", "versionEndExcluding": "5.18", "versionStartIncluding": "5.17.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7288ED8D-A02E-44A5-9C8A-A50DF9C5AE7F", "versionEndExcluding": "5.19.4", "versionStartIncluding": "5.18.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4/pnfs: Fix a use-after-free bug in open\n\nIf someone cancels the open RPC call, then we must not try to free\neither the open slot or the layoutget operation arguments, since they\nare likely still in use by the hung RPC call."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: NFSv4/pnfs: corrige un error de Use-After-Free en open Si alguien cancela la llamada RPC open, entonces no debemos intentar liberar ni la ranura abierta ni los argumentos de la operaci\u00f3n layoutget, ya que es probable que a\u00fan est\u00e9n en uso por la llamada RPC colgada."}], "id": "CVE-2022-50072", "lastModified": "2026-08-04T10:18:04.360", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-06-18T11:15:36.057", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0fffb46ff3d5ed4668aca96441ec7a25b793bd6f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2135e5d56278ffdb1c2e6d325dc6b87f669b9dac"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/76ffd2042438769298f34b76102b40dea89de616"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a4cf3dadd1fa43609f7c6570c9116b0e0a9923d1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b03d1117e9be7c7da60e466eaf9beed85c5916c8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f7ee3b772d9de87387a725caa04bc041ac7fe5ec"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:7000", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "kernel-0:4.18.0-553.22.1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-09-24T00:00:00Z"}, {"advisory": "RHSA-2023:6583", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-362.8.1.el9_3", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-11-07T00:00:00Z"}, {"advisory": "RHSA-2023:6583", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-362.8.1.el9_3", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-11-07T00:00:00Z"}], "bugzilla": {"description": "kernel: NFSv4/pnfs: Fix a use-after-free bug in open", "id": "2373562", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373562"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-763", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nNFSv4/pnfs: Fix a use-after-free bug in open\nIf someone cancels the open RPC call, then we must not try to free\neither the open slot or the layoutget operation arguments, since they\nare likely still in use by the hung RPC call."], "name": "CVE-2022-50072", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Under investigation", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-06-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-50072\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-50072\nhttps://lore.kernel.org/linux-cve-announce/2025061853-CVE-2022-50072-de2b@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-06-23T08:45:30.001105+00:00", "updated": "2025-06-23T08:45:30.001169+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}