CVE-2022-50235

NFSD: Protect against send buffer overflow in NFSv2 READDIR

State: Published
Severity: 9.8 Critical
Published: Sep 15, 2025
Updated: Aug 5, 2026
Reserved: Jun 18, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Protect against send buffer overflow in NFSv2 READDIR

Restore the previous limit on the @count argument to prevent a buffer overflow attack.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	9e291a6a28d32545ed2fd959a8165144d1724df1 to before 0e57d696f60dee6117a8ace0cac7c5761d375277Affected eabc0aab98e5218ceecd82069b0d6fdfff5ee885 to before dc7f225090c29a5f3b9419b1af32846a201555e7Affected 53b1119a6e5028b125f431a0116ba73510d82a72 to before c2a878095b5c6f04f90553a3c45872f990dab14eAffected 53b1119a6e5028b125f431a0116ba73510d82a72 to before f59c74df82f6ac9d2ea4e01aa3ae7c6c4481652dAffected 53b1119a6e5028b125f431a0116ba73510d82a72 to before 00b4492686e0497fdb924a9d4c8f6f99377e176cAffected 5.15.12 to before 5.15.75Affected
LinuxLinux	5.16Affected before 5.16Not affected 5.15.75 through 5.15.Not affected 5.19.17 through 5.19.Not affected 6.0.3 through 6.0.*Not affected 6.1 and laterNot affected

Product

Versions

LinuxLinux

9e291a6a28d32545ed2fd959a8165144d1724df1 to before 0e57d696f60dee6117a8ace0cac7c5761d375277Affected
eabc0aab98e5218ceecd82069b0d6fdfff5ee885 to before dc7f225090c29a5f3b9419b1af32846a201555e7Affected
53b1119a6e5028b125f431a0116ba73510d82a72 to before c2a878095b5c6f04f90553a3c45872f990dab14eAffected
53b1119a6e5028b125f431a0116ba73510d82a72 to before f59c74df82f6ac9d2ea4e01aa3ae7c6c4481652dAffected
53b1119a6e5028b125f431a0116ba73510d82a72 to before 00b4492686e0497fdb924a9d4c8f6f99377e176cAffected
5.15.12 to before 5.15.75Affected

LinuxLinux

5.16Affected
before 5.16Not affected
5.15.75 through 5.15.*Not affected
5.19.17 through 5.19.*Not affected
6.0.3 through 6.0.*Not affected
6.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.