NFSv4/pnfs: Fix a use-after-free bug in open (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.20 % · percentile 10 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: Fix a use-after-free bug in open If someone cancels the open RPC call, then we must not try to free either the open slot or the layoutget operation arguments, since they are likely still in use by the hung RPC call.
Weaknesses (CWE)
- CWE-416 — Use After Free
References
- https://git.kernel.org/stable/c/0fffb46ff3d5ed4668aca96441ec7a25b793bd6f
- https://git.kernel.org/stable/c/f7ee3b772d9de87387a725caa04bc041ac7fe5ec
- https://git.kernel.org/stable/c/76ffd2042438769298f34b76102b40dea89de616
- https://git.kernel.org/stable/c/a4cf3dadd1fa43609f7c6570c9116b0e0a9923d1
- https://git.kernel.org/stable/c/b03d1117e9be7c7da60e466eaf9beed85c5916c8
- https://git.kernel.org/stable/c/2135e5d56278ffdb1c2e6d325dc6b87f669b9dac
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2022-55341
- GCVE · GCVE-0-2022-50072
CERT-FR advisories
- CERTFR-2026-AVI-0081 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-1009 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0649 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0607 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0587 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.19.247 < 4.19.256cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.4.198 < 5.4.211cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.10.122 < 5.10.138cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.15.47 < 5.15.63cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.17.15 < 5.18cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.18.4 < 5.19.4
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 6b3fc1496e7227cd6a39a80bbfb7588ef7c7a010 < 0fffb46ff3d5ed4668aca96441ec7a25b793bd6f ; affected a2b3be930e79cc5d9d829f158e31172b2043f0cd < f7ee3b772d9de87387a725caa04bc041ac7fe5ec ; affected 0ee5b9644f06b4d3cdcd9544f43f63312e425a4c < 76ffd2042438769298f34b76102b40dea89de616 ; affected d4c2a041ed3ba114502d5ed6ace5b1a48d637a8e < a4cf3dadd1fa43609f7c6570c9116b0e0a9923d1 ; affected 6949493884fe88500de4af182588e071cf1544ee < b03d1117e9be7c7da60e466eaf9beed85c5916c8 ; affected 6949493884fe88500de4af182588e071cf1544ee < 2135e5d56278ffdb1c2e6d325dc6b87f669b9dac |
| Linux · Linux | affected 5.19 ; unaffected 0 < 5.19 ; unaffected 4.19.256 ≤ 4.19.* ; unaffected 5.4.211 ≤ 5.4.* ; unaffected 5.10.138 ≤ 5.10.* ; unaffected 5.15.63 ≤ 5.15.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |