Riskcovery

CVE-2022-49316

NFSv4: Don't hold the layoutget locks across multiple RPC calls

State
Published
Severity
5.5 Medium
Published
Feb 26, 2025
Updated
May 11, 2026
Reserved
Feb 26, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSv4: Don't hold the layoutget locks across multiple RPC calls

When doing layoutget as part of the open() compound, we have to be careful to release the layout locks before we can call any further RPC calls, such as setattr(). The reason is that those calls could trigger a recall, which could deadlock.

Scores

CVSSScoreVectorSource
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • 56f487f8c8fc5d6e582b79a86fc132d050129e15 to before 6b3fc1496e7227cd6a39a80bbfb7588ef7c7a010Affected
  • 56f487f8c8fc5d6e582b79a86fc132d050129e15 to before a2b3be930e79cc5d9d829f158e31172b2043f0cdAffected
  • 56f487f8c8fc5d6e582b79a86fc132d050129e15 to before 0ee5b9644f06b4d3cdcd9544f43f63312e425a4cAffected
  • 56f487f8c8fc5d6e582b79a86fc132d050129e15 to before d4c2a041ed3ba114502d5ed6ace5b1a48d637a8eAffected
  • 56f487f8c8fc5d6e582b79a86fc132d050129e15 to before 08d7a26d115cc7892668baa9750f64bd8baca29bAffected
  • 56f487f8c8fc5d6e582b79a86fc132d050129e15 to before ea759ae0a9ae5acee677d722129710ac89cc59c1Affected
  • 56f487f8c8fc5d6e582b79a86fc132d050129e15 to before 6949493884fe88500de4af182588e071cf1544eeAffected
LinuxLinux
  • 4.18Affected
  • before 4.18Not affected
  • 4.19.247 through 4.19.*Not affected
  • 5.4.198 through 5.4.*Not affected
  • 5.10.122 through 5.10.*Not affected
  • 5.15.47 through 5.15.*Not affected
  • 5.17.15 through 5.17.*Not affected
  • 5.18.4 through 5.18.*Not affected
  • 5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.