CVE-2022-50235
A critical flaw in the Linux kernel’s NFS server can cause a buffer overflow when processing NFSv2 READDIR requests. The bug allows an attacker to send a crafted request that may lead to arbitrary code execution or a crash. The issue has been fixed by restoring the original limit on the @count argument.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, including version 5.16 and later. Any system running a vulnerable kernel with NFSv2 enabled is at risk.
Real-world impact
An attacker can send a specially crafted NFSv2 READDIR request to a vulnerable server, causing a buffer overflow that could allow arbitrary code execution, denial of service, or privilege escalation on the affected system.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is network‑exploitable with no authentication or user interaction, and it can compromise confidentiality, integrity, and availability of the system.
What to do about it
- 01Check the current kernel version.
- 02Install the latest kernel update that includes the fix for CVE-2022-50235.
- 03Reboot the system to use the updated kernel.
NVD-referenced vendor advisory
Timeline
- Sep 15, 2025 · Sep 15, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 1d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.