CVE-2022-50235: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50235 is a send buffer overflow vulnerability in the Linux kernel's NFS daemon (NFSD), specifically in the NFSv2 READDIR operation. The flaw results from insufficient validation of the @count argument, allowing writes beyond the allocated send buffer. It was published on September 15, 2025, and affects Linux kernel versions 5.15.12–5.15.75, 5.16.x–5.19.17, and 6.0–6.0.3. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat CVE, Feedly).

The root cause is classified as CWE-787 (Out-of-bounds Write). The NFSD code handling NFSv2 READDIR requests failed to enforce a previous limit on the @count argument, allowing a caller to specify an excessively large value that causes the kernel to write beyond the boundaries of the allocated send buffer. Exploitation requires local access with low privileges (attack vector: local, privileges required: low), meaning an attacker must already have a foothold on the system or be able to issue NFS requests that reach the vulnerable code path. No public proof-of-concept or detailed technical write-up has been identified (Red Hat CVE, Feedly).

Successful exploitation could allow a local low-privileged attacker to cause a kernel buffer overflow, potentially leading to arbitrary code execution in kernel context. This would result in high impact to confidentiality, integrity, and availability of the affected system, including potential full system compromise. Lateral movement or privilege escalation to root is a realistic outcome if arbitrary kernel code execution is achieved (Red Hat CVE, Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term (Feedly).

Patches have been released for all affected kernel branches: upgrade to Linux kernel 5.15.75 or later (for the 5.15.x branch), 5.19.17 or later (for the 5.16.x–5.19.x branch), or 6.0.3 or later (for the 6.0.x branch); kernel 6.1 and later are not affected. The fix restores the previous limit on the @count argument in the NFSv2 READDIR handler. As interim mitigations, administrators should restrict NFS service access to trusted networks, limit local user privileges, and disable NFSv2 if it is not required (Red Hat CVE, Amazon Linux Advisory).

Red Hat tracked the issue via Bugzilla (BZ#2395362) and published a CVE advisory. Amazon Web Services issued an advisory for Amazon Linux 2 kernel 5.15 (ALAS2KERNEL-5.15-2025-090). SUSE released kernel update advisories (SUSE-2025-03613-1, SUSE-2025-03628-1, SUSE-2025-3716-1) addressing this CVE. No notable independent researcher commentary or significant social media discussion has been identified (Red Hat CVE, Amazon Linux Advisory, SUSE Advisory).