CVE-2022-50861 NFSD: Finish converting the NFSv2 GETACL result encoder
A flaw in the Linux kernel NFS server leaks stale memory contents to clients due to incorrect buffer length handling in the GETACL encoder.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50861?
CVE-2022-50861 is a high-severity vulnerability in Linux, published on 30 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Finish converting the NFSv2 GETACL result encoder
The xdr_stream conversion inadvertently left some code that set the page_len of the send buffer. The XDR stream encoders should handle this automatically now.
This oversight adds garbage past the end of the Reply message. Clients typically ignore the garbage, but NFSD does not need to send it, as it leaks stale memory contents onto the wire.
Which versions are affected by CVE-2022-50861?
How do I fix CVE-2022-50861?
Apply the vendor's patch.
Is CVE-2022-50861 being exploited?
There is no known exploitation of CVE-2022-50861 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2022-50861, GHSA-fvjx-6c9m-3p89, UBUNTU-CVE-2022-50861.