CVE-2022-48827 Linux CVE debrief

Who should care

Linux distribution maintainers, system administrators, and appliance vendors running kernels with NFS server functionality enabled, especially on versions listed as vulnerable by NVD. Operators should also care if they rely on NFS clients that may hang or repeatedly retry when a server mishandles end-of-file boundary reads.

Technical summary

According to the NVD description, an NFS READ close to the end of the addressable range can cause loff_t overflow in the server. The server then returns NFS EINVAL, which the Linux NFS client does not handle for READ and may retry indefinitely. NVD lists the issue as affecting Linux kernel releases before 5.10.220, 5.11 through 5.15.23, 5.16 through 5.16.9, and 5.17-rc1 through 5.17-rc3. The kernel fix treats out-of-range READs as successful short reads with EOF and emphasizes explicit u64-to-loff_t conversion so VFS limits are checked correctly.

Defensive priority

High

Recommended defensive actions

• Apply the kernel updates or vendor backports that include the published fixes for CVE-2022-48827.
• Verify whether deployed kernels fall within the NVD-listed affected ranges before scheduling remediation.
• Prioritize systems exposing NFS server functionality or running workloads that may read near EOF or address-space limits.
• After patching, validate NFS behavior with normal application tests and confirm clients no longer hang or retry endlessly on boundary reads.
• Track vendor advisories and stable kernel updates for backported fixes if you do not deploy mainline kernel releases.

Evidence notes

NVD’s CVE record describes the failure mode: a READ near OFFSET_MAX can overflow loff_t, causing EINVAL and client retry behavior. The record also lists CWE-125 and CVSS v3.1 7.1 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H). NVD includes kernel patch references and lists vulnerable kernel version ranges in the CPE criteria.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.