Answer in brief
CVE-2022-50401 records a Critical severity (CVSS 9.8) vulnerability in nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=69151594c72a1748cf93ae5b5fa68d5084253dce <707bcca9616002d204091ca7c4d1d91151104332 || >=0c4fb76c4e711d9e4e70ddc6732310a17076175d <15fc60aa5bdcf6d5f93000d3d00579fc67632ee0 || >=22c721560ef24003bcb9c3d9c358841dcfa4e212 <9b4ae8c42d2ff09ed7c5832ccce5684c55e5ed23 || >=e8cac2e3067e8587f8271c2177cc5ca924a61b54 <fddac3b4578d302ac9e51e7f03a9aae6254ae2a3 || >=a4abc6b12eb1f7a533c2e7484cfa555454ff0977 <c1207219a4bfa50121c9345d5d165470d0a82531 || >=a4abc6b12eb1f7a533c2e7484cfa555454ff0977 <a472f069ced8601979f53c13c0cf20236074ed46 || >=a4abc6b12eb1f7a533c2e7484cfa555454ff0977 <e2f9f03e4537f3fcc8fd2bdd3248530c3477a371 || >=a4abc6b12eb1f7a533c2e7484cfa555454ff0977 <d843ebd860c58a38e45527e8ec6516059f4c97f3 || >=a4abc6b12eb1f7a533c2e7484cfa555454ff0977 <3bc8edc98bd43540dbe648e4ef91f443d6d20a24 || f5a50e848e4509448b8b91536b5d421722bf154b || c745f9ef3c8cbae70556131eaeaf0f64510243b7 || >=4.9.229 <4.9.337 || >=4.14.186 <4.14.303 || >=4.19.130 <4.19.270 || >=5.4.49 <5.4.229 || >=4.4.229 <4.5 || >=5.7.6 <5.8 | 707bcca9616002d204091ca7c4d1d91151104332, 15fc60aa5bdcf6d5f93000d3d00579fc67632ee0, 9b4ae8c42d2ff09ed7c5832ccce5684c55e5ed23, fddac3b4578d302ac9e51e7f03a9aae6254ae2a3, c1207219a4bfa50121c9345d5d165470d0a82531, a472f069ced8601979f53c13c0cf20236074ed46, e2f9f03e4537f3fcc8fd2bdd3248530c3477a371, d843ebd860c58a38e45527e8ec6516059f4c97f3, 3bc8edc98bd43540dbe648e4ef91f443d6d20a24, 4.9.337, 4.14.303, 4.19.270, 5.4.229, 4.5, 5.8 |
| Linux/Linuxgeneric | 5.8 | Not reported |
Published upstream
Sep 18, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 4, 2026
In the Linux kernel, the following vulnerability has been resolved: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure On error situation `clp->cl_cb_conn.cb_xprt` should not be given a reference to the xprt otherwise both client cleanup and the error handling path of the caller call to put it. Better to delay handing over the reference to a later branch. [ 72.530665] refcount_t: underflow; use-after-free. [ 72.531933] WARNING: CPU: 0 PID: 173 at lib/refcount.c:28 refcount_warn_saturate+0xcf/0x120 [ 72.533075] Modules linked in: nfsd(OE) nfsv4(OE) nfsv3(OE) nfs(OE) lockd(OE) compat_nfs_ssc(OE) nfs_acl(OE) rpcsec_gss_krb5(OE) auth_rpcgss(OE) rpcrdma(OE) dns_resolver fscache netfs grace rdma_cm iw_cm ib_cm sunrpc(OE) mlx5_ib mlx5_core mlxfw pci_hyperv_intf ib_uverbs ib_core xt_MASQUERADE nf_conntrack_netlink nft_counter xt_addrtype nft_compat br_netfilter bridge stp llc nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set overlay nf_tables nfnetlink crct10dif_pclmul crc32_pclmul ghash_clmulni_intel xfs serio_raw virtio_net virtio_blk net_failover failover fuse [last unloaded: sunrpc] [ 72.540389] CPU: 0 PID: 173 Comm: kworker/u16:5 Tainted: G OE 5.15.82-dan #1 [ 72.541511] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-3.module+el8.7.0+1084+97b81f61 04/01/2014 [ 72.542717] Workqueue: nfsd4_callbacks nfsd4_run_cb_work [nfsd] [ 72.543575] RIP: 0010:refcount_warn_saturate+0xcf/0x120 [ 72.544299] Code: 55 00 0f 0b 5d e9 01 50 98 00 80 3d 75 9e 39 08 00 0f 85 74 ff ff ff 48 c7 c7 e8 d1 60 8e c6 05 61 9e 39 08 01 e8 f6 51 55 00 <0f> 0b 5d e9 d9 4f 98 00 80 3d 4b 9e 39 08 00 0f 85 4c ff ff ff 48 [ 72.546666] RSP: 0018:ffffb3f841157cf0 EFLAGS: 00010286 [ 72.547393] RAX: 0000000000000026 RBX: ffff89ac6231d478 RCX: 0000000000000000 [ 72.548324] RDX: ffff89adb7c2c2c0 RSI: ffff89adb7c205c0 RDI: ffff89adb7c205c0 [ 72.549271] RBP: ffffb3f841157cf0 R08: 0000000000000000 R09: c0000000ffefffff [ 72.550209] R10: 0000000000000001 R11: ffffb3f841157ad0 R12: ffff89ac6231d180 [ 72.551142] R13: ffff89ac6231d478 R14: ffff89ac40c06180 R15: ffff89ac6231d4b0 [ 72.552089] FS: 0000000000000000(0000) GS:ffff89adb7c00000(0000) knlGS:0000000000000000 [ 72.553175] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 72.553934] CR2: 0000563a310506a8 CR3: 0000000109a66000 CR4: 0000000000350ef0 [ 72.554874] Call Trace: [ 72.555278] <TASK> [ 72.555614] svc_xprt_put+0xaf/0xe0 [sunrpc] [ 72.556276] nfsd4_process_cb_update.isra.11+0xb7/0x410 [nfsd] [ 72.557087] ? update_load_avg+0x82/0x610 [ 72.557652] ? cpuacct_charge+0x60/0x70 [ 72.558212] ? dequeue_entity+0xdb/0x3e0 [ 72.558765] ? queued_spin_unlock+0x9/0x20 [ 72.559358] nfsd4_run_cb_work+0xfc/0x270 [nfsd] [ 72.560031] process_one_work+0x1df/0x390 [ 72.560600] worker_thread+0x37/0x3b0 [ 72.561644] ? process_one_work+0x390/0x390 [ 72.562247] kthread+0x12f/0x150 [ 72.562710] ? set_kthread_struct+0x50/0x50 [ 72.563309] ret_from_fork+0x22/0x30 [ 72.563818] </TASK> [ 72.564189] ---[ end trace 031117b1c72ec616 ]--- [ 72.566019] list_add corruption. next->prev should be prev (ffff89ac4977e538), but was ffff89ac4763e018. (next=ffff89ac4763e018). [ 72.567647] ------------[ cut here ]------------
Quoted source text, attributed separately from HOL analysis.