HighFix available
NFSv4/pnfs: Fix a use-after-free bug in open
Type: advisorySources: OSV
In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: Fix a use-after-free bug in open If someone cancels the open RPC call, then we must not try to free either the open slot or the layoutget operation arguments, since they are likely still in use by the hung RPC call.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 4.19.256, 5.10.138, 5.15.63, 5.19.4, 5.4.211
- CVEs
- CVE-2022-50072
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 8 Nov 2026, 02:57 UTC · Revision 1
Source evidence
NFSv4/pnfs: Fix a use-after-free bug in open
core-osv · Original sourcePublished 18 Jun 2025, 11:02 UTC
In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: Fix a use-after-free bug in open If someone cancels the open RPC call, then we must not try to free either the open slot or the layoutget operation arguments, since they are likely still in use by the hung RPC call.
osv:CVE-2022-50072
Kernel
Fixed versions: 4.19.256, 5.4.211, 5.10.138, 5.15.63, 5.19.4
Complete source record
{
"id": "07300027fac391b40ff516721af2bebe2cafd8c2682d9acf2b9a8103f4ebd8b1",
"url": "https://osv.dev/vulnerability/CVE-2022-50072",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "NFSv4/pnfs: Fix a use-after-free bug in open",
"summary": "In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: Fix a use-after-free bug in open If someone cancels the open RPC call, then we must not try to free either the open slot or the layoutget operation arguments, since they are likely still in use by the hung RPC call.",
"evidence": "osv:CVE-2022-50072",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.19.256",
"evidence": "/affected/1/ranges"
},
{
"value": "5.4.211",
"evidence": "/affected/1/ranges"
},
{
"value": "5.10.138",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.63",
"evidence": "/affected/1/ranges"
},
{
"value": "5.19.4",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2022-50072",
"aliases": [
"CVE-2022-50072"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6b3fc1496e7227cd6a39a80bbfb7588ef7c7a010"
},
{
"fixed": "0fffb46ff3d5ed4668aca96441ec7a25b793bd6f"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "a2b3be930e79cc5d9d829f158e31172b2043f0cd"
},
{
"fixed": "f7ee3b772d9de87387a725caa04bc041ac7fe5ec"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "0ee5b9644f06b4d3cdcd9544f43f63312e425a4c"
},
{
"fixed": "76ffd2042438769298f34b76102b40dea89de616"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "d4c2a041ed3ba114502d5ed6ace5b1a48d637a8e"
},
{
"fixed": "a4cf3dadd1fa43609f7c6570c9116b0e0a9923d1"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6949493884fe88500de4af182588e071cf1544ee"
},
{
"fixed": "b03d1117e9be7c7da60e466eaf9beed85c5916c8"
},
{
"fixed": "2135e5d56278ffdb1c2e6d325dc6b87f669b9dac"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "4.19.247"
},
{
"fixed": "4.19.256"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.4.198"
},
{
"fixed": "5.4.211"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.10.122"
},
{
"fixed": "5.10.138"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.15.47"
},
{
"fixed": "5.15.63"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.17.15"
},
{
"fixed": "5.18"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.18.4"
},
{
"fixed": "5.19"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "08d7a26d115cc7892668baa9750f64bd8baca29b"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "ea759ae0a9ae5acee677d722129710ac89cc59c1"
}
]
}
],
"versions": [
"v4.19.255",
"v4.19.254",
"v4.19.253",
"v4.19.252",
"v4.19.251",
"v4.19.250",
"v4.19.249",
"v4.19.248",
"v4.19.247",
"v5.4.210",
"v5.4.209",
"v5.4.208",
"v5.4.207",
"v5.4.206",
"v5.4.205",
"v5.4.204",
"v5.4.203",
"v5.4.202",
"v5.4.201",
"v5.4.200",
"v5.4.199",
"v5.4.198",
"v5.10.137",
"v5.10.136",
"v5.10.135",
"v5.10.134",
"v5.10.133",
"v5.10.132",
"v5.10.131",
"v5.10.130",
"v5.10.129",
"v5.10.128",
"v5.10.127",
"v5.10.126",
"v5.10.125",
"v5.10.124",
"v5.10.123",
"v5.10.122",
"v5.15.62",
"v5.15.61",
"v5.15.60",
"v5.15.59",
"v5.15.58",
"v5.15.57",
"v5.15.56",
"v5.15.55",
"v5.15.54",
"v5.15.53",
"v5.15.52",
"v5.15.51",
"v5.15.50",
"v5.15.49",
"v5.15.48",
"v5.15.47",
"v5.17.15",
"v5.18.19",
"v5.18.18",
"v5.18.17",
"v5.18.16",
"v5.18.15",
"v5.18.14",
"v5.18.13",
"v5.18.12",
"v5.18.11",
"v5.18.10",
"v5.18.9",
"v5.18.8",
"v5.18.7",
"v5.18.6",
"v5.18.5",
"v5.18.4"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50072.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.19.256"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.20.0"
},
{
"fixed": "5.4.211"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.5.0"
},
{
"fixed": "5.10.138"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.63"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "5.19.4"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50072.json"
}
}
],
"modified": "2026-10-28T02:30:53.391416189Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/0fffb46ff3d5ed4668aca96441ec7a25b793bd6f",
"https://git.kernel.org/stable/c/2135e5d56278ffdb1c2e6d325dc6b87f669b9dac",
"https://git.kernel.org/stable/c/76ffd2042438769298f34b76102b40dea89de616",
"https://git.kernel.org/stable/c/a4cf3dadd1fa43609f7c6570c9116b0e0a9923d1",
"https://git.kernel.org/stable/c/b03d1117e9be7c7da60e466eaf9beed85c5916c8",
"https://git.kernel.org/stable/c/f7ee3b772d9de87387a725caa04bc041ac7fe5ec",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50072.json",
"https://nvd.nist.gov/vuln/detail/CVE-2022-50072",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50072.json"
}
},
"related_cves": [
{
"value": "CVE-2022-50072",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 522000,
"published_at": "2025-06-18T11:02:16.658+00:00"
}