CVE-2022-50241: NFSD: fix use-after-free on source server when doing inter-server copy
In the Linux kernel, the following vulnerability has been resolved:
NFSD: fix use-after-free on source server when doing inter-server copy
Use-after-free occurred when the laundromat tried to free expired
cpntf_state entry on the s2s_cp_stateids list after inter-server
copy completed. The sc_cp_list that the expired copy state was
inserted on was already freed.
When COPY completes, the Linux client normally sends LOCKU(lock_state x),
FREE_STATEID(lock_state x) and CLOSE(open_state y) to the source server.
The nfs4_put_stid call from nfsd4_free_stateid cleans up the copy state
from the s2s_cp_stateids list before freeing the lock state's stid.
However, sometimes the CLOSE was sent before the FREE_STATEID request.
When this happens, the nfsd4_close_open_stateid call from nfsd4_close
frees all lock states on its st_locks list without cleaning up the copy
state on the sc_cp_list list. When the time the FREE_STATEID arrives the
server returns BAD_STATEID since the lock state was freed. This causes
the use-after-free error to occur when the laundromat tries to free
the expired cpntf_state.
This patch adds a call to nfs4_free_cpntf_statelist in
nfsd4_close_open_stateid to clean up the copy state before calling
free_ol_stateid_reaplist to free the lock state's stid on the reaplist.
Security readout for executives and security teams
Plain-English summary
CVE-2022-50241 is a Linux kernel NFSD bug involving NFSv4 inter-server copy. A timing/order issue can leave stale copy state and later trigger use-after-free cleanup on the source server. Public sources do not provide CVSS, confirmed exploitation, or business impact details.
Executive priority
Prioritize for Linux NFS servers, especially file infrastructure using NFSv4 inter-server copy. Treat as routine-to-important patching unless those servers are highly critical or exposed to untrusted NFS clients. Lack of CVSS and exploitation evidence lowers urgency, but kernel memory bugs still merit timely remediation.
Technical view
The flaw is in NFSD server-side NFSv4 copy state handling. If CLOSE arrives before FREE_STATEID after COPY, lock state can be freed without removing related cpntf_state from sc_cp_list. Later laundromat cleanup may access freed memory. Kernel stable commits add nfs4_free_cpntf_statelist cleanup in nfsd4_close_open_stateid.
Likely exposure
Exposure is most relevant to Linux systems running NFSD with NFSv4 inter-server copy enabled or used. The CVE record lists Linux kernel affected version entries including 5.6, 5.10.150, 5.15.75, 5.19.17, 6.0.3, and 6.1. Distro kernel backports require vendor verification.
Exploitation context
No active exploitation is indicated in the provided sources, and the CVE is not marked KEV. The described trigger depends on NFS client request ordering during inter-server copy. Sources do not state whether remote attackers can reliably exploit this beyond causing the vulnerable state sequence.
Researcher notes
Public detail is limited to the kernel fix description and stable commit references. No CVSS, CWE, exploit status, or distro-specific fixed package list is included. Analysis should focus on NFSD state lifecycle, affected kernel branch mapping, and whether inter-server copy is reachable in the local environment.
Mitigation direction
Identify Linux NFS servers running NFSD and NFSv4 inter-server copy workloads.
Review vendor kernel advisories for CVE-2022-50241 and applicable backported fixes.
Update to a kernel containing the referenced stable NFSD fixes where available.
If patching is delayed, assess whether inter-server copy use can be reduced or disabled per vendor guidance.
Validation and detection
Inventory kernel versions and distro package release levels on NFS servers.
Check whether NFSD is enabled and serving NFSv4 workloads.
Map installed kernels to vendor advisories or the referenced stable commits.
Review kernel logs for NFSD instability, crashes, or use-after-free reports.
Confirm remediation through package metadata or vendor-fixed kernel changelog.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2022-50241 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
6Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Sep 15, 2025, 14:01 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.