CVE-2022-48828 Linux CVE debrief

Who should care

Linux kernel maintainers, distro security teams, and administrators running kernel NFS server services (NFSD) on affected releases should care most. This is especially relevant for systems that rely on NFSv3 or NFSv4 attribute handling and need to keep kernel packages current.

Technical summary

The Linux kernel uses loff_t for iattr::ia_size, which is a signed 64-bit type, while NFSv3 and NFSv4 file sizes are defined as unsigned 64-bit values. According to the source description, decode_fattr4() can place a full u64 into ia_size, and if the value is larger than S64_MAX, the signed field underflows. The fix catches this condition in nfsd_setattr(), the shared code path for the NFS server attribute update logic. NVD classifies the weakness as CWE-191 and rates the issue CVSS 3.1 5.5 MEDIUM (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Defensive priority

Medium. Prioritize through normal kernel patch management, and elevate sooner on hosts that run NFSD or otherwise depend on NFS server functionality for production workloads.

Recommended defensive actions

• Apply kernel updates that include the referenced NFSD ia_size underflow fix.
• Check whether running kernels fall within the vulnerable NVD CPE ranges: before 5.4.295, 5.5 through before 5.10.220, 5.11 through before 5.15.24, 5.16 through before 5.16.10, and 5.17-rc1 through rc3.
• Schedule maintenance for Linux systems providing NFS server services, especially those using NFSv3 or NFSv4.
• Use the linked kernel patch references to confirm your downstream distribution has incorporated the fix.
• Continue routine monitoring of NFS server behavior and kernel logs while remediation is in progress.

Evidence notes

This debrief is based only on the supplied NVD record, its CVSS and CPE data, and the referenced kernel patch links. The source description explicitly states that a u64 file-size value can underflow signed iattr::ia_size and that the fix belongs in nfsd_setattr(). The NVD record identifies CWE-191 and provides the availability-focused CVSS vector. No exploit details or unsupported impact claims are included.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.