🛡️ CVE-2022-50487 on Debian — linux

⚪ Unknown ✅ No Known Exploit OSV
N/A
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv3 READDIR Since before the git era, NFSD has conserved the number of pages held by each nfsd thread by combining the RPC receive and send buffers into a single array of pages. This works because there are no cases where an operation needs a large RPC Call message and a large RPC Reply message at the same time. Once an RPC Call has been received, svc_process() updates svc_rqst::rq_res to describe the part of rq_pages that can be used for constructing the Reply. This means that the send buffer (rq_res) shrinks when the received RPC record containing the RPC Call is large. A client can force this shrinkage on TCP by sending a correctly- formed RPC Call header contained in an RPC record that is excessively large. The full maximum payload size cannot be constructed in that case. Thanks to Aleksi Illikainen and Kari Hulkko for uncovering this issue.

Distribution advisory

This page covers CVE-2022-50487 as tracked by Debian, for the package linux. The fix is available in version 6.0.3-1; earlier versions remain affected.

Affected software

DEBIAN-CVE-2022-50487 is recorded against 1 package.

  • linux (fixed in 6.0.3-1)

Timeline and source

Published on 4 October 2025 and last revised on 4 November 2025. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

security-tracker.debian.org (Advisory)

CVE-2022-50487 on other distributions

Each distribution ships its own build and its own fixed version. Pick the one you run:

Details

Severity Unknown
CVSS Score N/A
CVSS Vector N/A
CWE N/A
Public Exploit ✅ No
Source OSV
Published 2025-10-04
Updated 2026-08-12
Modified 2025-11-04
Fix URL N/A

Affected Packages

Software From version Fixed in
linux — 6.0.3-1

Similar Threats

Free Vulnerability Check

Is your site affected by DEBIAN-CVE-2022-50487?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against DEBIAN-CVE-2022-50487 and other known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Browse related advisories

All advisoriesDebianDebian 2022