LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50241: NFSD: fix use-after-free on source server when doing inter-server copy

In the Linux kernel, the following vulnerability has been resolved: NFSD: fix use-after-free on source server when doing inter-server copy Use-after-free occurred when the laundromat tried to free expired cpntf_state entry on the s2s_cp_stateids list after inter-server copy completed. The sc_cp_list that the expired copy state was inserted on was already freed. When COPY completes, the Linux client normally sends LOCKU(lock_state x), FREE_STATEID(lock_state x) and CLOSE(open_state y) to the source server. The nfs4_put_stid call from nfsd4_free_stateid cleans up the copy state from the s2s_cp_stateids list before freeing the lock state's stid. However, sometimes the CLOSE was sent before the FREE_STATEID request. When this happens, the nfsd4_close_open_stateid call from nfsd4_close frees all lock states on its st_locks list without cleaning up the copy state on the sc_cp_list list. When the time the FREE_STATEID arrives the server returns BAD_STATEID since the lock state was freed. This causes the use-after-free error to occur when the laundromat tries to free the expired cpntf_state. This patch adds a call to nfs4_free_cpntf_statelist in nfsd4_close_open_stateid to clean up the copy state before calling free_ol_stateid_reaplist to free the lock state's stid on the reaplist.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-50241 is a Linux kernel NFSD bug involving NFSv4 inter-server copy. A timing/order issue can leave stale copy state and later trigger use-after-free cleanup on the source server. Public sources do not provide CVSS, confirmed exploitation, or business impact details.

Executive priority

Prioritize for Linux NFS servers, especially file infrastructure using NFSv4 inter-server copy. Treat as routine-to-important patching unless those servers are highly critical or exposed to untrusted NFS clients. Lack of CVSS and exploitation evidence lowers urgency, but kernel memory bugs still merit timely remediation.

Technical view

The flaw is in NFSD server-side NFSv4 copy state handling. If CLOSE arrives before FREE_STATEID after COPY, lock state can be freed without removing related cpntf_state from sc_cp_list. Later laundromat cleanup may access freed memory. Kernel stable commits add nfs4_free_cpntf_statelist cleanup in nfsd4_close_open_stateid.

Likely exposure

Exposure is most relevant to Linux systems running NFSD with NFSv4 inter-server copy enabled or used. The CVE record lists Linux kernel affected version entries including 5.6, 5.10.150, 5.15.75, 5.19.17, 6.0.3, and 6.1. Distro kernel backports require vendor verification.

Exploitation context

No active exploitation is indicated in the provided sources, and the CVE is not marked KEV. The described trigger depends on NFS client request ordering during inter-server copy. Sources do not state whether remote attackers can reliably exploit this beyond causing the vulnerable state sequence.

Researcher notes

Public detail is limited to the kernel fix description and stable commit references. No CVSS, CWE, exploit status, or distro-specific fixed package list is included. Analysis should focus on NFSD state lifecycle, affected kernel branch mapping, and whether inter-server copy is reachable in the local environment.

Mitigation direction

  • Identify Linux NFS servers running NFSD and NFSv4 inter-server copy workloads.
  • Review vendor kernel advisories for CVE-2022-50241 and applicable backported fixes.
  • Update to a kernel containing the referenced stable NFSD fixes where available.
  • If patching is delayed, assess whether inter-server copy use can be reduced or disabled per vendor guidance.

Validation and detection

  • Inventory kernel versions and distro package release levels on NFS servers.
  • Check whether NFSD is enabled and serving NFSv4 workloads.
  • Map installed kernels to vendor advisories or the referenced stable commits.
  • Review kernel logs for NFSD instability, crashes, or use-after-free reports.
  • Confirm remediation through package metadata or vendor-fixed kernel changelog.
Prepared
Confidence
medium
Sources
7

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50241 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux624322f1adc58acd0b69f77a6ddc764207e97241, 624322f1adc58acd0b69f77a6ddc764207e97241, 624322f1adc58acd0b69f77a6ddc764207e97241, 624322f1adc58acd0b69f77a6ddc764207e97241, 624322f1adc58acd0b69f77a6ddc764207e97241unaffected
LinuxLinux5.6, 0, 5.10.150, 5.15.75, 5.19.17, 6.0.3, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.