CVE-2022-49362

NFSD: Fix potential use-after-free in nfsd_file_put()

State: Published
Severity: 9.8 Critical
Published: Feb 26, 2025
Updated: Aug 5, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Fix potential use-after-free in nfsd_file_put()

nfsd_file_put_noref() can free @nf, so don't dereference @nf immediately upon return from nfsd_file_put_noref().

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	9862064ca81f9b9da8ebe26c86cf2b10c293ba1a to before ada1757b259f353cade47037ee0a0249b4cddad3Affected a98e5b3d958ac697aafb3d077eb2cca4a731b7ee to before 261eabe19cb28e4a8587a4442d257b543d7c2d57Affected 999397926ab3f78c7d1235cc4ca6e3c89d2769bf to before 333dcc94ebf53f79f3dc0e7a7c16700bc7ff7e57Affected 999397926ab3f78c7d1235cc4ca6e3c89d2769bf to before b6c71c66b0ad8f2b59d9bc08c7a5079b110bec01Affected
LinuxLinux	5.18Affected before 5.18Not affected 5.18.4 through 5.18.*Not affected 5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.