CVE-2022-50401— nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于NFSv4.1协议下rpc_create失败时导致双重svc_xprt_put调用，可能引起释放后重用问题。
Possible ATT&CK Techniques 1 AI
T1211 · Exploitation for StealthAffected Version Matrix 28
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 69151594c72a1748cf93ae5b5fa68d5084253dce< 707bcca9616002d204091ca7c4d1d91151104332 |
affected |
0c4fb76c4e711d9e4e70ddc6732310a17076175d< 15fc60aa5bdcf6d5f93000d3d00579fc67632ee0 |
affected | ||
22c721560ef24003bcb9c3d9c358841dcfa4e212< 9b4ae8c42d2ff09ed7c5832ccce5684c55e5ed23 |
affected | ||
e8cac2e3067e8587f8271c2177cc5ca924a61b54< fddac3b4578d302ac9e51e7f03a9aae6254ae2a3 |
affected | ||
a4abc6b12eb1f7a533c2e7484cfa555454ff0977< c1207219a4bfa50121c9345d5d165470d0a82531 |
affected | ||
a4abc6b12eb1f7a533c2e7484cfa555454ff0977< a472f069ced8601979f53c13c0cf20236074ed46 |
affected | ||
a4abc6b12eb1f7a533c2e7484cfa555454ff0977< e2f9f03e4537f3fcc8fd2bdd3248530c3477a371 |
affected | ||
a4abc6b12eb1f7a533c2e7484cfa555454ff0977< d843ebd860c58a38e45527e8ec6516059f4c97f3 |
affected | ||
| … +20 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-50401
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure
On error situation `clp->cl_cb_conn.cb_xprt` should not be given
a reference to the xprt otherwise both client cleanup and the
error handling path of the caller call to put it. Better to
delay handing over the reference to a later branch.
[ 72.530665] refcount_t: underflow; use-after-free.
[ 72.531933] WARNING: CPU: 0 PID: 173 at lib/refcount.c:28 refcount_warn_saturate+0xcf/0x120
[ 72.533075] Modules linked in: nfsd(OE) nfsv4(OE) nfsv3(OE) nfs(OE) lockd(OE) compat_nfs_ssc(OE) nfs_acl(OE) rpcsec_gss_krb5(OE) auth_rpcgss(OE) rpcrdma(OE) dns_resolver fscache netfs grace rdma_cm iw_cm ib_cm sunrpc(OE) mlx5_ib mlx5_core mlxfw pci_hyperv_intf ib_uverbs ib_core xt_MASQUERADE nf_conntrack_netlink nft_counter xt_addrtype nft_compat br_netfilter bridge stp llc nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set overlay nf_tables nfnetlink crct10dif_pclmul crc32_pclmul ghash_clmulni_intel xfs serio_raw virtio_net virtio_blk net_failover failover fuse [last unloaded: sunrpc]
[ 72.540389] CPU: 0 PID: 173 Comm: kworker/u16:5 Tainted: G OE 5.15.82-dan #1
[ 72.541511] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-3.module+el8.7.0+1084+97b81f61 04/01/2014
[ 72.542717] Workqueue: nfsd4_callbacks nfsd4_run_cb_work [nfsd]
[ 72.543575] RIP: 0010:refcount_warn_saturate+0xcf/0x120
[ 72.544299] Code: 55 00 0f 0b 5d e9 01 50 98 00 80 3d 75 9e 39 08 00 0f 85 74 ff ff ff 48 c7 c7 e8 d1 60 8e c6 05 61 9e 39 08 01 e8 f6 51 55 00 <0f> 0b 5d e9 d9 4f 98 00 80 3d 4b 9e 39 08 00 0f 85 4c ff ff ff 48
[ 72.546666] RSP: 0018:ffffb3f841157cf0 EFLAGS: 00010286
[ 72.547393] RAX: 0000000000000026 RBX: ffff89ac6231d478 RCX: 0000000000000000
[ 72.548324] RDX: ffff89adb7c2c2c0 RSI: ffff89adb7c205c0 RDI: ffff89adb7c205c0
[ 72.549271] RBP: ffffb3f841157cf0 R08: 0000000000000000 R09: c0000000ffefffff
[ 72.550209] R10: 0000000000000001 R11: ffffb3f841157ad0 R12: ffff89ac6231d180
[ 72.551142] R13: ffff89ac6231d478 R14: ffff89ac40c06180 R15: ffff89ac6231d4b0
[ 72.552089] FS: 0000000000000000(0000) GS:ffff89adb7c00000(0000) knlGS:0000000000000000
[ 72.553175] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 72.553934] CR2: 0000563a310506a8 CR3: 0000000109a66000 CR4: 0000000000350ef0
[ 72.554874] Call Trace:
[ 72.555278] <TASK>
[ 72.555614] svc_xprt_put+0xaf/0xe0 [sunrpc]
[ 72.556276] nfsd4_process_cb_update.isra.11+0xb7/0x410 [nfsd]
[ 72.557087] ? update_load_avg+0x82/0x610
[ 72.557652] ? cpuacct_charge+0x60/0x70
[ 72.558212] ? dequeue_entity+0xdb/0x3e0
[ 72.558765] ? queued_spin_unlock+0x9/0x20
[ 72.559358] nfsd4_run_cb_work+0xfc/0x270 [nfsd]
[ 72.560031] process_one_work+0x1df/0x390
[ 72.560600] worker_thread+0x37/0x3b0
[ 72.561644] ? process_one_work+0x390/0x390
[ 72.562247] kthread+0x12f/0x150
[ 72.562710] ? set_kthread_struct+0x50/0x50
[ 72.563309] ret_from_fork+0x22/0x30
[ 72.563818] </TASK>
[ 72.564189] ---[ end trace 031117b1c72ec616 ]---
[ 72.566019] list_add corruption. next->prev should be prev (ffff89ac4977e538), but was ffff89ac4763e018. (next=ffff89ac4763e018).
[ 72.567647] ------------[ cut here ]------------
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于NFSv4.1协议下rpc_create失败时导致双重svc_xprt_put调用，可能引起释放后重用问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2022-50401
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-50401
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-09-18 · 121 CVEs total
| CVE-2022-50410 | 9.8 CRITICAL | NFSD: Protect against send buffer overflow in NFSv2 READ |
| CVE-2023-53382 | 9.8 CRITICAL | net/smc: Reset connection when trying to use SMCRv2 fails. |
| CVE-2022-50419 | 8.8 HIGH | Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times |
| CVE-2023-53431 | 8.8 HIGH | scsi: ses: Handle enclosure with just a primary component gracefully |
| CVE-2023-53432 | 8.8 HIGH | firewire: net: fix use after free in fwnet_finish_incoming_packet() |
| CVE-2022-50413 | 8.8 HIGH | wifi: mac80211: fix use-after-free |
| CVE-2023-53374 | 8.8 HIGH | Bluetooth: hci_conn: fail SCO/ISO via hci_conn_failed if ACL gone early |
| CVE-2022-50386 | 8.8 HIGH | Bluetooth: L2CAP: Fix user-after-free |
| CVE-2023-53372 | 8.2 HIGH | sctp: fix a potential overflow in sctp_ifwdtsn_skip |
| CVE-2022-50399 | 7.8 HIGH | media: atomisp: prevent integer overflow in sh_css_set_black_frame() |
| CVE-2023-53398 | 7.8 HIGH | mlx5: fix possible ptp queue fifo use-after-free |
| CVE-2023-53394 | 7.8 HIGH | net/mlx5e: xsk: Fix crash on regular rq reactivation |
| CVE-2022-50417 | 7.8 HIGH | drm/panfrost: Fix GEM handle creation ref-counting |
| CVE-2023-53429 | 7.8 HIGH | btrfs: don't check PageError in __extent_writepage |
| CVE-2023-53387 | 7.8 HIGH | scsi: ufs: core: Fix device management cmd timeout flow |
| CVE-2023-53373 | 7.8 HIGH | crypto: seqiv - Handle EBUSY correctly |
| CVE-2023-53378 | 7.8 HIGH | drm/i915/dpt: Treat the DPT BO as a framebuffer |
| CVE-2023-53426 | 7.8 HIGH | xsk: Fix xsk_diag use-after-free error during socket cleanup |
| CVE-2023-53386 | 7.8 HIGH | Bluetooth: Fix potential use-after-free when clear keys |
| CVE-2023-53388 | 7.8 HIGH | drm/mediatek: Clean dangling pointer on bind error path |
Showing top 20 of 121 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
Same vendor: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
V. Comments for CVE-2022-50401
No comments yet