Log in Start free

Vulnerability · Published Feb 26, 2025 · Assigned by Linux

CVE-2022-49316NFSv4: Don't hold the layoutget locks across multiple RPC calls

Medium 5.5

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 88.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Don't hold the layoutget locks across multiple RPC calls When doing layoutget as part of the open() compound, we have to be careful to release the layout locks before we can call any further RPC calls, such as setattr(). The reason is that those calls could trigger a recall, which could deadlock.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux5.18.5-1DEBIAN-CVE-2022-49316
Debian:13linux5.18.5-1DEBIAN-CVE-2022-49316
Debian:14linux5.18.5-1DEBIAN-CVE-2022-49316
Rocky Linux:8kernel0:4.18.0-553.22.1.el8_10RLSA-2024:7000
Ubuntu:22.04:LTSlinux5.15.0-48.54UBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-aws5.15.0-1020.24UBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-azure5.15.0-1020.25UBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1024.30.1UBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-gcp5.15.0-1018.24UBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-gke5.15.0-1016.19UBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1003.5UBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-ibm5.15.0-1015.17UBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1016.21UBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-kvm5.15.0-1018.22UBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-48.54UBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1007.7UBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-oracle5.15.0-1018.23UBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-raspi5.15.0-1015.17UBUNTU-CVE-2022-49316
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2022-49316
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2022-49316

Affected products (as reported)

VendorProductVersions
Linux Linux 56f487f8c8fc5d6e582b79a86fc132d050129e15 – before 6b3fc1496e7227cd6a39a80bbfb7588ef7c7a01056f487f8c8fc5d6e582b79a86fc132d050129e15 – before a2b3be930e79cc5d9d829f158e31172b2043f0cd56f487f8c8fc5d6e582b79a86fc132d050129e15 – before 0ee5b9644f06b4d3cdcd9544f43f63312e425a4c56f487f8c8fc5d6e582b79a86fc132d050129e15 – before d4c2a041ed3ba114502d5ed6ace5b1a48d637a8e56f487f8c8fc5d6e582b79a86fc132d050129e15 – before 08d7a26d115cc7892668baa9750f64bd8baca29b56f487f8c8fc5d6e582b79a86fc132d050129e15 – before ea759ae0a9ae5acee677d722129710ac89cc59c156f487f8c8fc5d6e582b79a86fc132d050129e15 – before 6949493884fe88500de4af182588e071cf1544ee
Linux Linux 4.18

Weakness: CWE-667 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References