CVE-2022-49362

CVE-2022-49362 is a use-after-free vulnerability in the Linux kernel's NFSD component, specifically within the nfsd_file_put() function. The issue arises because nfsd_file_put_noref() can free the @nf object, but the code subsequently dereferences @nf immediately upon its return, leading to potential memory corruption. This flaw is classified under CWE-416 (Use After Free) and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability.

A local attacker with low privileges can exploit this vulnerability due to its low attack complexity and lack of user interaction requirements. Successful exploitation could allow the attacker to trigger the use-after-free condition, potentially resulting in arbitrary code execution, data corruption, or kernel crashes within the context of the NFSD process.

Mitigation involves applying the relevant stable kernel patches, as detailed in the upstream commit references. These patches address the issue by ensuring that @nf is not dereferenced immediately after the call to nfsd_file_put_noref(), preventing the use-after-free scenario across affected kernel versions.