CVE-2022-50072 – This CVE describes a use-after-free vulnerabili... (How to Fix)

Q: What is the severity of CVE-2022-50072?

CVE-2022-50072 has a CVSS score of 7.8 (HIGH). This CVE describes a use-after-free vulnerability in the Linux kernel's NFSv4/pnfs implementation. When an open RPC call is cancelled, the kernel incorrectly frees memory that may still be in use by the hung RPC call, potentially leading to system crashes or arbitrary code execution. This affects Linux systems using NFSv4 with pnfs extensions.

📋 TL;DR

This CVE describes a use-after-free vulnerability in the Linux kernel's NFSv4/pnfs implementation. When an open RPC call is cancelled, the kernel incorrectly frees memory that may still be in use by the hung RPC call, potentially leading to system crashes or arbitrary code execution. This affects Linux systems using NFSv4 with pnfs extensions.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific kernel versions between 5.15 and 5.19 (exact range depends on distribution backports)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when NFSv4 with pnfs (parallel NFS) is configured and in use. Most default configurations do not enable pnfs.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, or potential privilege escalation to kernel-level code execution allowing full system compromise.

🟠

Likely Case

System instability, crashes, or denial of service affecting NFS operations.

🟢

If Mitigated

Limited impact if NFSv4/pnfs is not used or if systems are patched promptly.

🌐 Internet-Facing: LOW - NFS is typically used internally, not exposed directly to the internet.

🏢 Internal Only: MEDIUM - Affects internal systems using NFSv4 with pnfs, but requires specific conditions to trigger.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires specific conditions: NFSv4/pnfs must be active, and an open RPC call must be cancelled. This is a race condition vulnerability.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel 5.19.12 and later stable versions, plus backports to various distribution kernels

Vendor Advisory: https://git.kernel.org/stable/c/2135e5d56278ffdb1c2e6d325dc6b87f669b9dac

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution's repositories. 2. For Red Hat/CentOS: yum update kernel. 3. For Ubuntu/Debian: apt update && apt upgrade linux-image. 4. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable pnfs

linux

Disable parallel NFS (pnfs) feature in NFSv4 configuration

echo 'options nfs nfs4_disable_idmapping=1' > /etc/modprobe.d/nfs-pnfs.conf
reboot

Use NFSv3 instead

linux

Configure NFS clients and servers to use NFSv3 instead of NFSv4

On client: mount -t nfs -o vers=3 server:/export /mnt
On server: In /etc/exports, specify options for NFSv3

🧯 If You Can't Patch

Disable NFSv4 pnfs functionality on all affected systems
Implement network segmentation to isolate NFS traffic and limit potential impact

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if NFSv4 with pnfs is enabled: uname -r && cat /proc/fs/nfsfs/volumes

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is patched: uname -r should show 5.19.12 or higher, or distribution-specific patched version

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages in /var/log/messages or dmesg
NFS-related crashes or hung processes

Network Indicators:

Unusual NFS traffic patterns or connection resets

SIEM Query:

source="kernel" AND ("panic" OR "Oops" OR "use-after-free") AND ("nfs" OR "pnfs")

📊 Metadata

CVE ID: CVE-2022-50072

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.02% exploit probability (3.7th percentile)

Published: June 18, 2025

Last Updated: November 17, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-50072, you might also want to check these: