Security readout for executives and security teams
Plain-English summary
CVE-2022-49927 is a Linux kernel NFSv4 client memory leak. If slot allocation fails during NFSv4 client setup, previously allocated slots may not be cleaned up. The main business risk is local availability degradation on affected Linux systems, not data theft or remote compromise.
Executive priority
Treat as a routine-to-prioritized Linux availability fix. It should be included in normal kernel patch cycles, with faster handling for shared infrastructure, NFS-heavy environments, and systems where local users can repeatedly exercise NFS mount paths.
Technical view
The issue is CWE-401 in Linux kernel NFSv4 slot table allocation. The reported path includes nfs4_find_or_create_slot, nfs4_realloc_slot_table, nfs40_init_client, and mount handling. CVSS 3.1 is 5.5: local attack vector, low complexity, low privileges, no user interaction, high availability impact.
Likely exposure
Exposure is most relevant to Linux systems running affected kernel versions and using NFSv4 client functionality. The source data lists affected Linux versions including 3.12, 4.9.333, 4.14.299, 4.19.265, 5.4.224, 5.10.154, 5.15.78, 6.0.8, and 6.1.
Exploitation context
The CVE record does not identify active exploitation, and it is not in KEV. The CVSS vector indicates local, low-privilege conditions. The source evidence supports an availability-oriented memory leak during NFSv4 mount/client initialization, not remote code execution or confidentiality impact.
Researcher notes
Evidence is limited to the CVE record, CVSS vector, CWE, affected version data, and Linux stable commit references. No source in the bundle describes real-world exploitation, a public exploit, or a vendor-specific package mapping.
Mitigation direction
- Update affected Linux kernels to vendor releases containing the referenced stable fixes.
- Prioritize systems that use NFSv4 clients or allow user-triggered NFS mounts.
- Check distribution vendor advisories for exact fixed package versions.
- Restrict untrusted local ability to trigger NFSv4 mounts where operationally feasible.
Validation and detection
- Inventory Linux kernel versions across servers, workstations, and appliances.
- Identify systems with NFSv4 client use or mount workflows.
- Confirm installed kernel packages include the relevant stable fix from the vendor.
- Review monitoring for memory pressure or OOM events around NFS mount activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49927 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/84b5cb476903003ae9ca88f32b57ff0eaefa6d4cCVE reference, Linux
- https://git.kernel.org/stable/c/aae35a0c8a775fa4afa6a4e7dab3f936f1f89bbbCVE reference, Linux
- https://git.kernel.org/stable/c/86ce0e93cf6fb4d0c447323ac66577c642628b9dCVE reference, Linux
- https://git.kernel.org/stable/c/925cb538bd5851154602818dc80bf4b4d924c127CVE reference, Linux
- https://git.kernel.org/stable/c/45aea4fbf61e205649c29200726b9f45c1718a67CVE reference, Linux
- https://git.kernel.org/stable/c/24641993a7dce6b1628645f4e1d97ca06c9f765dCVE reference, Linux
- https://git.kernel.org/stable/c/db333ae981fb8843c383aa7dbf62cc682597d401CVE reference, Linux
- https://git.kernel.org/stable/c/7e8436728e22181c3f12a5dbabd35ed3a8b8c593CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.