{"id":"CVE-2022-50302","state":"PUBLISHED","title":"lockd: set other missing fields when unlocking files","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nlockd: set other missing fields when unlocking files\n\nvfs_lock_file() expects the struct file_lock to be fully initialised by\nthe caller. Re-exported NFSv3 has been seen to Oops if the fl_file field\nis NULL.","publishedAt":"2025-09-15T14:45:57.924Z","updatedAt":"2026-08-05T08:58:05.609Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"486c1acf14233b1ff7b37e6f026a737a2f7f53f1","status":"affected","lessThan":"31c93ee5f1e4dc278b562e20f3c3274ac34997f3","versionType":"git"},{"version":"9c3eef773cf4a8a18f959234bbb4c0a55c31ab71","status":"affected","lessThan":"95d42a8d3d4ae84a0bd3ee23e1fee240cdf0a9f0","versionType":"git"},{"version":"aec158242b87a43d83322e99bc71ab4428e5ab79","status":"affected","lessThan":"688575aef211b0986fc51010116f5888a99d76a2","versionType":"git"},{"version":"aec158242b87a43d83322e99bc71ab4428e5ab79","status":"affected","lessThan":"d7aa9f7778316beb690f6e2763b6d672ad8b256f","versionType":"git"},{"version":"aec158242b87a43d83322e99bc71ab4428e5ab79","status":"affected","lessThan":"18ebd35b61b4693a0ddc270b6d4f18def232e770","versionType":"git"},{"version":"58c3f48a540b821b3253e2dc31c8fa237293ffc9","status":"affected","versionType":"git"},{"version":"5.15.56","status":"affected","lessThan":"5.15.86","versionType":"semver"},{"version":"5.18.13","status":"affected","lessThan":"5.19","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/lockd/svcsubs.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.19","versionType":"semver"},{"version":"5.15.86","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.0.16","status":"unaffected","lessThanOrEqual":"6.0.*","versionType":"semver"},{"version":"6.1.2","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/lockd/svcsubs.c"]}],"references":["https://git.kernel.org/stable/c/31c93ee5f1e4dc278b562e20f3c3274ac34997f3","https://git.kernel.org/stable/c/95d42a8d3d4ae84a0bd3ee23e1fee240cdf0a9f0","https://git.kernel.org/stable/c/688575aef211b0986fc51010116f5888a99d76a2","https://git.kernel.org/stable/c/d7aa9f7778316beb690f6e2763b6d672ad8b256f","https://git.kernel.org/stable/c/18ebd35b61b4693a0ddc270b6d4f18def232e770"],"weaknesses":[],"ingestedAt":"2026-10-29T20:05:26.763Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/50xxx/CVE-2022-50302.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-50302","state":"PUBLISHED","datePublished":"2025-09-15T14:45:57.924Z","dateUpdated":"2026-08-05T08:58:05.609Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-09-15T14:18:36.812Z"},"containers":{"cna":{"title":"lockd: set other missing fields when unlocking files","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nlockd: set other missing fields when unlocking files\n\nvfs_lock_file() expects the struct file_lock to be fully initialised by\nthe caller. Re-exported NFSv3 has been seen to Oops if the fl_file field\nis NULL."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"486c1acf14233b1ff7b37e6f026a737a2f7f53f1","status":"affected","lessThan":"31c93ee5f1e4dc278b562e20f3c3274ac34997f3","versionType":"git"},{"version":"9c3eef773cf4a8a18f959234bbb4c0a55c31ab71","status":"affected","lessThan":"95d42a8d3d4ae84a0bd3ee23e1fee240cdf0a9f0","versionType":"git"},{"version":"aec158242b87a43d83322e99bc71ab4428e5ab79","status":"affected","lessThan":"688575aef211b0986fc51010116f5888a99d76a2","versionType":"git"},{"version":"aec158242b87a43d83322e99bc71ab4428e5ab79","status":"affected","lessThan":"d7aa9f7778316beb690f6e2763b6d672ad8b256f","versionType":"git"},{"version":"aec158242b87a43d83322e99bc71ab4428e5ab79","status":"affected","lessThan":"18ebd35b61b4693a0ddc270b6d4f18def232e770","versionType":"git"},{"version":"58c3f48a540b821b3253e2dc31c8fa237293ffc9","status":"affected","versionType":"git"},{"version":"5.15.56","status":"affected","lessThan":"5.15.86","versionType":"semver"},{"version":"5.18.13","status":"affected","lessThan":"5.19","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/lockd/svcsubs.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.19","versionType":"semver"},{"version":"5.15.86","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.0.16","status":"unaffected","lessThanOrEqual":"6.0.*","versionType":"semver"},{"version":"6.1.2","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/lockd/svcsubs.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/31c93ee5f1e4dc278b562e20f3c3274ac34997f3"},{"url":"https://git.kernel.org/stable/c/95d42a8d3d4ae84a0bd3ee23e1fee240cdf0a9f0"},{"url":"https://git.kernel.org/stable/c/688575aef211b0986fc51010116f5888a99d76a2"},{"url":"https://git.kernel.org/stable/c/d7aa9f7778316beb690f6e2763b6d672ad8b256f"},{"url":"https://git.kernel.org/stable/c/18ebd35b61b4693a0ddc270b6d4f18def232e770"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - lockd’s NLM service is network-facing (TCP/UDP), and nlmsvc_proc_free_all remotely invokes nlmsvc_free_host_resources → nlm_unlock_files, the vulnerable path; NFS re-export servers expose this to network clients.\nAC:L - An attacker who can take NLM locks on a re-exported NFSv3 share can reliably trigger the bug via FREE_ALL (or induce host-resource cleanup); no conditions beyond attacker control are required once that deployment is in place.\nPR:N - NLM accepts AUTH_NULL/AUTH_UNIX with no real credentials on the target; obtaining locks and calling FREE_ALL needs only network reachability to an allowed NFS/NLM export, not privileges on the vulnerable host.\nUI:N - Exploitation is entirely via attacker-sent NLM RPCs; no victim user action is required.\nS:U - Impact is a kernel oops/panic in the lockd/nfsd host’s own kernel authority, with no crossing of a VM, IOMMU, or other security boundary.\nC:N - The defect is a pure NULL fl_file dereference in nlmclnt_setlockargs (file_inode(NULL)); it does not provide an information-disclosure or memory-read primitive.\nI:N - This is a NULL pointer dereference crash path, not memory corruption, UAF, or an attacker-controlled write; it does not yield integrity compromise or code execution.\nA:H - The NULL deref oopses lockd and the reported failure escalates to a full kernel panic, hard-denying service on the NFS re-export server."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T08:58:05.609Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.56","versionEndExcluding":"5.15.86"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.0.16"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.1.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18.13"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}