CVE-2022-50455: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50455 was initially assigned to a null pointer dereference vulnerability in the Linux kernel's NFS subsystem, specifically in the nfs_fs_context_parse_param() function, which failed to check whether param->string was a null pointer before dereferencing it when parsing zero-length filesystem string parameters. The CVE was published on October 1, 2025, and subsequently rejected by its CVE Numbering Authority (kernel.org) on October 10, 2025. No CVSS score has been assigned by NVD due to the rejection status (NVD).

The originally described issue involved a null pointer dereference (CWE-476) in the Linux kernel's NFS filesystem context parsing code. According to the original description, vfs_parse_fs_string() sets param->string to a null pointer when a filesystem string of zero length is provided, and nfs_fs_context_parse_param() would dereference this pointer without a prior null check. The proposed fix was to add a sanity check on param->string within nfs_fs_context_parse_param(). However, because this CVE has been officially rejected and withdrawn by kernel.org, the technical details and associated patch commits have been removed from the NVD record (NVD).

Because CVE-2022-50455 has been rejected and withdrawn by its CVE Numbering Authority, no official impact assessment is applicable. The originally described null pointer dereference, if valid, could have caused a kernel panic or denial of service on systems using NFS mounts with zero-length string parameters, but this assessment is moot given the rejection (NVD).

CVE-2022-50455 has been rejected and is not considered a valid, exploitable vulnerability. No exploit code, proof-of-concept, or in-the-wild exploitation has been reported. The EPSS score is 0.00019 (effectively negligible), and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (NVD).

No mitigation or patching action is required, as CVE-2022-50455 has been officially rejected and withdrawn by kernel.org. Organizations that may have tracked this CVE in vulnerability management systems should update their records to reflect its rejected status (NVD).