Security readout for executives and security teams
Plain-English summary
This Linux kernel NFSv4 flaw can crash a system during a referral lookup, shown by the source crash trace from an ls operation. The available sources describe a kernel stability issue, not confirmed data theft or privilege escalation. Public evidence does not show active exploitation.
Executive priority
Treat this as a targeted availability risk for Linux systems using NFSv4, not as a confirmed broad compromise event. Prioritize patch validation in fleets with NFS dependency or high uptime requirements.
Technical view
CVE-2022-49418 fixes freeing an uninitialized nfs4_label during NFSv4 referral lookup. The kernel change passes the already allocated fattr with nfs4_fs_locations and removes a fattr memcpy path that led to a crash in nfs_lookup.
Likely exposure
Exposure is most relevant to Linux systems using NFSv4 referral lookups on affected kernel builds. The source bundle lists Linux kernel versions including 5.16 and a fix boundary at 5.18.3, but complete distro package mapping is not provided.
Exploitation context
KEV is false, and the provided sources do not report active exploitation or public exploit use. The described impact is a kernel crash during NFS lookup behavior, which could affect availability where affected NFSv4 paths are reachable.
Researcher notes
Evidence is limited to the CVE record and kernel stable fixes. No CVSS, CWE, exploit status, or distro-specific package data is included. The safest conclusion is a kernel crash condition fixed upstream, with exposure dependent on NFSv4 referral behavior.
Mitigation direction
- Check Linux vendor advisories for fixed kernel packages covering CVE-2022-49418.
- Upgrade affected kernels to a vendor-supported fixed release.
- Prioritize systems that mount or serve NFSv4 referrals.
- Avoid relying on upstream commit IDs alone for distro package status.
Validation and detection
- Inventory Linux kernel versions on systems using NFSv4.
- Confirm whether deployed kernels include the referenced stable fixes.
- Review NFS usage for referral lookup exposure.
- Check logs for kernel crashes involving nfs_lookup or NFSv4 referral paths.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-49418 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/6015292653d95ba9f72906e2b65e536aa5807d64CVE reference, Linux
- https://git.kernel.org/stable/c/c3ed222745d9ad7b69299b349a64ba533c64a34fCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.