CVE-2022-50861: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50861 is a Linux kernel vulnerability in the NFSD (NFS server daemon) subsystem affecting the NFSv2 GETACL result encoder. During an XDR stream conversion, code that manually set the page_len of the send buffer was inadvertently left in place, causing stale kernel memory contents to be appended past the end of NFS reply messages and leaked onto the network wire. The vulnerability affects Linux kernel versions from 5.13 up to the patched stable releases (5.15.86, 6.0.16, 6.1.2, and 6.2). It was published on December 30, 2025, and carries an estimated CVSS severity of Medium with an EPSS score of 0.000180 (Feedly, EUVD).

The root cause is an incomplete refactoring of the NFSv2 GETACL XDR encoder in the Linux kernel's NFSD subsystem. When the encoder was converted to use XDR streams, legacy code that explicitly set page_len on the send buffer was not removed. Because XDR stream encoders manage buffer boundaries automatically, the residual page_len assignment causes extra data — specifically stale kernel memory — to be appended beyond the legitimate end of the NFS reply message. This constitutes an out-of-bounds read / information disclosure scenario (related to CWE-200: Exposure of Sensitive Information). The issue is triggered when an NFSv2 client issues a GETACL request to a vulnerable NFS server; no authentication bypass or special privileges are required on the client side beyond normal NFS access (Feedly, EUVD).

The primary impact is an information disclosure: stale kernel memory contents are leaked over the network in NFS reply messages to any NFSv2 client performing GETACL operations. While NFS clients typically ignore the trailing garbage data, the leaked memory may contain sensitive kernel data such as cryptographic material, credentials, or other in-memory artifacts. There is no direct impact on integrity or availability, and the vulnerability does not enable remote code execution or privilege escalation on its own (Feedly, EUVD).

The fix has been backported to multiple stable Linux kernel branches. Administrators should upgrade to kernel version 5.15.86, 6.0.16, 6.1.2, or 6.2 (or later), which contain the corrected NFSD NFSv2 GETACL encoder. The relevant upstream commits are a20b0abab966, 5030d4d2bf8b, d5b867fd2d7f, 2b825efb0577, and ea5021e911d3. As a temporary workaround, disabling NFSv2 exports on the server (if NFSv2 is not required) eliminates exposure to this code path (EUVD, Kernel Commit).