CVE-2022-50853: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50853 is a credential leak vulnerability in the Linux kernel's NFSv4 subsystem, specifically within the _nfs4_discover_trunking() function. The flaw was published on December 30, 2025, and affects Linux kernel versions introduced by commit 4f40a5b5544618b096d1611a18219dd91fd57f80, with fixes backported to stable releases including 5.15.86, 6.0.16, 6.1.2, and 6.2. It carries an estimated CVSS severity of Medium and an EPSS score of approximately 0.018% (Feedly, CIRCL).

The root cause is improper resource management (CWE-401 or similar resource leak) in the NFSv4 trunking discovery path: when _nfs4_discover_trunking() encounters certain error conditions, it fails to release (put) the credential object it acquired, resulting in a reference count leak. This is a kernel-internal bug that does not require network-level interaction to trigger — it manifests during NFSv4 session establishment when trunking discovery is performed. The fix involves ensuring the credential is properly released on all exit paths within the function (Feedly, Linux Kernel Git).

The primary impact is a kernel memory/resource leak: credentials (authentication tokens or key references) are not properly freed, which can lead to resource exhaustion over time if the code path is repeatedly triggered. In practice, this could degrade system stability on NFS clients performing trunking discovery, but it does not directly expose credentials to unauthorized parties or enable remote code execution. The confidentiality, integrity, and availability impacts are considered low to moderate, primarily affecting availability through potential resource exhaustion (Feedly).

Apply the upstream Linux kernel patches that fix the credential leak in _nfs4_discover_trunking(). Fixed versions include stable releases 5.15.86, 6.0.16, 6.1.2, and 6.2 (or later). Users running affected kernel versions should update to a patched stable release as provided by their Linux distribution. No configuration-based workaround is known; disabling NFSv4 trunking discovery may reduce exposure but is not an officially recommended mitigation (Feedly, Linux Kernel Git).