GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50302 (GCVE-0-2022-50302)

Vulnerability from cvelistv5 – Published: 2025-09-15 14:45 – Updated: 2026-08-05 08:58
VLAI
Title
lockd: set other missing fields when unlocking files
Summary
In the Linux kernel, the following vulnerability has been resolved: lockd: set other missing fields when unlocking files vfs_lock_file() expects the struct file_lock to be fully initialised by the caller. Re-exported NFSv3 has been seen to Oops if the fl_file field is NULL.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 486c1acf14233b1ff7b37e6f026a737a2f7f53f1 , < 31c93ee5f1e4dc278b562e20f3c3274ac34997f3 (git)
Affected: 9c3eef773cf4a8a18f959234bbb4c0a55c31ab71 , < 95d42a8d3d4ae84a0bd3ee23e1fee240cdf0a9f0 (git)
Affected: aec158242b87a43d83322e99bc71ab4428e5ab79 , < 688575aef211b0986fc51010116f5888a99d76a2 (git)
Affected: aec158242b87a43d83322e99bc71ab4428e5ab79 , < d7aa9f7778316beb690f6e2763b6d672ad8b256f (git)
Affected: aec158242b87a43d83322e99bc71ab4428e5ab79 , < 18ebd35b61b4693a0ddc270b6d4f18def232e770 (git)
Affected: 58c3f48a540b821b3253e2dc31c8fa237293ffc9 (git)
Affected: 5.15.56 , < 5.15.86 (semver)
Affected: 5.18.13 , < 5.19 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.19
Unaffected: 0 , < 5.19 (semver)
Unaffected: 5.15.86 , ≤ 5.15.* (semver)
Unaffected: 6.0.16 , ≤ 6.0.* (semver)
Unaffected: 6.1.2 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/lockd/svcsubs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "31c93ee5f1e4dc278b562e20f3c3274ac34997f3",
              "status": "affected",
              "version": "486c1acf14233b1ff7b37e6f026a737a2f7f53f1",
              "versionType": "git"
            },
            {
              "lessThan": "95d42a8d3d4ae84a0bd3ee23e1fee240cdf0a9f0",
              "status": "affected",
              "version": "9c3eef773cf4a8a18f959234bbb4c0a55c31ab71",
              "versionType": "git"
            },
            {
              "lessThan": "688575aef211b0986fc51010116f5888a99d76a2",
              "status": "affected",
              "version": "aec158242b87a43d83322e99bc71ab4428e5ab79",
              "versionType": "git"
            },
            {
              "lessThan": "d7aa9f7778316beb690f6e2763b6d672ad8b256f",
              "status": "affected",
              "version": "aec158242b87a43d83322e99bc71ab4428e5ab79",
              "versionType": "git"
            },
            {
              "lessThan": "18ebd35b61b4693a0ddc270b6d4f18def232e770",
              "status": "affected",
              "version": "aec158242b87a43d83322e99bc71ab4428e5ab79",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "58c3f48a540b821b3253e2dc31c8fa237293ffc9",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.86",
              "status": "affected",
              "version": "5.15.56",
              "versionType": "semver"
            },
            {
              "lessThan": "5.19",
              "status": "affected",
              "version": "5.18.13",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/lockd/svcsubs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.86",
                  "versionStartIncluding": "5.15.56",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.16",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.2",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.18.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlockd: set other missing fields when unlocking files\n\nvfs_lock_file() expects the struct file_lock to be fully initialised by\nthe caller. Re-exported NFSv3 has been seen to Oops if the fl_file field\nis NULL."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - lockd\u2019s NLM service is network-facing (TCP/UDP), and nlmsvc_proc_free_all remotely invokes nlmsvc_free_host_resources \u2192 nlm_unlock_files, the vulnerable path; NFS re-export servers expose this to network clients.\nAC:L - An attacker who can take NLM locks on a re-exported NFSv3 share can reliably trigger the bug via FREE_ALL (or induce host-resource cleanup); no conditions beyond attacker control are required once that deployment is in place.\nPR:N - NLM accepts AUTH_NULL/AUTH_UNIX with no real credentials on the target; obtaining locks and calling FREE_ALL needs only network reachability to an allowed NFS/NLM export, not privileges on the vulnerable host.\nUI:N - Exploitation is entirely via attacker-sent NLM RPCs; no victim user action is required.\nS:U - Impact is a kernel oops/panic in the lockd/nfsd host\u2019s own kernel authority, with no crossing of a VM, IOMMU, or other security boundary.\nC:N - The defect is a pure NULL fl_file dereference in nlmclnt_setlockargs (file_inode(NULL)); it does not provide an information-disclosure or memory-read primitive.\nI:N - This is a NULL pointer dereference crash path, not memory corruption, UAF, or an attacker-controlled write; it does not yield integrity compromise or code execution.\nA:H - The NULL deref oopses lockd and the reported failure escalates to a full kernel panic, hard-denying service on the NFS re-export server."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:58:05.609Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/31c93ee5f1e4dc278b562e20f3c3274ac34997f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/95d42a8d3d4ae84a0bd3ee23e1fee240cdf0a9f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/688575aef211b0986fc51010116f5888a99d76a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7aa9f7778316beb690f6e2763b6d672ad8b256f"
        },
        {
          "url": "https://git.kernel.org/stable/c/18ebd35b61b4693a0ddc270b6d4f18def232e770"
        }
      ],
      "title": "lockd: set other missing fields when unlocking files",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50302",
    "datePublished": "2025-09-15T14:45:57.924Z",
    "dateReserved": "2025-09-15T14:18:36.812Z",
    "dateUpdated": "2026-08-05T08:58:05.609Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50302",
      "date": "2026-09-16",
      "epss": "0.00361",
      "percentile": "0.29659"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50302\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-15T15:15:41.720\",\"lastModified\":\"2026-08-04T10:18:10.267\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nlockd: set other missing fields when unlocking files\\n\\nvfs_lock_file() expects the struct file_lock to be fully initialised by\\nthe caller. Re-exported NFSv3 has been seen to Oops if the fl_file field\\nis NULL.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/lockd/svcsubs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"486c1acf14233b1ff7b37e6f026a737a2f7f53f1\",\"lessThan\":\"31c93ee5f1e4dc278b562e20f3c3274ac34997f3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9c3eef773cf4a8a18f959234bbb4c0a55c31ab71\",\"lessThan\":\"95d42a8d3d4ae84a0bd3ee23e1fee240cdf0a9f0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aec158242b87a43d83322e99bc71ab4428e5ab79\",\"lessThan\":\"688575aef211b0986fc51010116f5888a99d76a2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aec158242b87a43d83322e99bc71ab4428e5ab79\",\"lessThan\":\"d7aa9f7778316beb690f6e2763b6d672ad8b256f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aec158242b87a43d83322e99bc71ab4428e5ab79\",\"lessThan\":\"18ebd35b61b4693a0ddc270b6d4f18def232e770\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"58c3f48a540b821b3253e2dc31c8fa237293ffc9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.15.56\",\"lessThan\":\"5.15.86\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.18.13\",\"lessThan\":\"5.19\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/lockd/svcsubs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.86\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0.16\",\"lessThanOrEqual\":\"6.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.2\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.56\",\"versionEndExcluding\":\"5.15.86\",\"matchCriteriaId\":\"49BA1967-9889-4B6D-93A3-F0A6B2CD73EB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18.13\",\"versionEndExcluding\":\"5.19\",\"matchCriteriaId\":\"B70F816A-AF29-46E5-95C8-FA44312EE737\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.19.1\",\"versionEndExcluding\":\"6.0.16\",\"matchCriteriaId\":\"0C2620B2-2842-4E85-A95E-ECF91003E1ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1\",\"versionEndExcluding\":\"6.1.2\",\"matchCriteriaId\":\"77239F4B-6BB2-4B9E-A654-36A52396116C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"9D759CCF-9E1B-41B2-81AA-CB580C5F3EEC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"C178431E-AD82-4B3D-B70F-A273A02ABD5D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"2CF5D19C-C418-4B57-B52D-7795547F4096\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/18ebd35b61b4693a0ddc270b6d4f18def232e770\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/31c93ee5f1e4dc278b562e20f3c3274ac34997f3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/688575aef211b0986fc51010116f5888a99d76a2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/95d42a8d3d4ae84a0bd3ee23e1fee240cdf0a9f0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d7aa9f7778316beb690f6e2763b6d672ad8b256f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:40:04+00:00",
      "cve": "CVE-2022-50302",
      "id": "CVE-2022-50302",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "201",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel lockd: Denial of Service via uninitialized file lock field in NFSv3",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50302.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T02:22:02Z",
      "cve": "CVE-2022-50302",
      "id": "CVE-2022-50302",
      "initial_release_date": "2025-09-15T23:29:29Z",
      "product_status:known_not_affected": "523",
      "product_status:recommended": "27",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50302",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50302.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.