CVE-2022-50861 Details
Description
In the Linux kernel, the following vulnerability has been resolved: NFSD: Finish converting the NFSv2 GETACL result encoder The xdr_stream conversion inadvertently left some code that set the page_len of the send buffer. The XDR stream encoders should handle this automatically now. This oversight adds garbage past the end of the Reply message. Clients typically ignore the garbage, but NFSD does not need to send it, as it leaks stale memory contents onto the wire.
A vulnerability in the Linux kernel's NFSD component for NFSv2 GETACL result encoding has been addressed. The issue arose from an improper conversion to the XDR stream, which left behind code that manually set the send buffer's page length. This mistake caused the encoder to append unnecessary data beyond the intended Reply message, potentially leaking outdated memory contents over the network. While most clients disregard this extraneous data, it is unnecessary for NFSD to transmit it.
Users can upgrade to the latest stable version of the Linux kernel to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Dec 30, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/2b825efb0577a32a872e872a869e0947cf9dd6d3 | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/5030d4d2bf8b6f6f3d16401ab92a88bc5aa2377a | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/a20b0abab966a189a79aba6ebf41f59024a3224d | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/d5b867fd2d7f79630b1a2906a7bb4f4b75bf297a | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/ea5021e911d3479346a75ac9b7d9dcd751b0fb99 | kernel.org | Source CodeVendor |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| Linux kernel | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 4, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Dec 30, 2025 | New CVE Received | kernel.org |