CVE-2022-49280
A critical flaw in the Linux kernel’s NFS server can let attackers read or write arbitrary data. The bug is caused by an integer underflow in the write arguments decoder, which can be triggered remotely.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
All Linux kernel users running a kernel version that has not yet been patched for CVE-2022-49280, especially those exposing NFS services to the network.
Real-world impact
An attacker could read or modify files on the system, potentially taking full control of the affected machine.
Why this severity
The CVSS score of 9.8 reflects that the flaw is exploitable over the network, requires no user interaction, and can compromise confidentiality, integrity, and availability.
What to do about it
- 01Update your Linux kernel to a version that includes the patch for CVE-2022-49280.
- 02Reboot the system to load the new kernel.
NVD-referenced vendor advisory
Timeline
- Feb 26, 2025 · Feb 26, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.