Read the docs
TI-2022-21589 Aliases CVE-2022-43945GHSA-42x7-fjc5-38vr

Resource allocation without limits in linux_kernel

Priority MEDIUM 47CWE-131Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-131 and the CVSS impact.

Summary

The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer to shrink by sending an RPC message over TCP with garbage data added at the end of the message. The RPC message with garbage data is still correctly formed according to the specification and is passed forward to handlers. Vulnerable code in NFSD is not expecting the oversized request and writes beyond the allocated buffer space. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.05456 92nd percentileScored 2026-11-07
Fix Fixed linux_kernel (linux): 6.0.2Red Hat: 9 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Linuxlinux_kernelbefore 6.0.26.0.2Patch availableCNA
  • linux_kernel VendorLinux Affected before 6.0.2 Fixed in 6.0.2 Patch available CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*before 5.19.17; 6.0 to before 6.0.2VulnerableLinux
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*not specified by NVDVulnerableNetApp
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions before 5.19.17; 6.0 to before 6.0.2 Vulnerable ·Linux
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
  • cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp

Remediation

  • Fix · CNA linux_kernel (linux) Fixed in 6.0.2

Red Hat 9 advisories

  • RHSA-2023:0832 Released 2023-02-21 · Red Hat rating Important
    kernel security and bug fix update
    • Red Hat CodeReady Linux Builder (v. 8) kernel-tools-libs-devel-4.18.0-425.13.1.el8_7
    • Red Hat Enterprise Linux BaseOS (v. 8) bpftool-4.18.0-425.13.1.el8_7, kernel-4.18.0-425.13.1.el8_7, kernel-abi-stablelists-4.18.0-425.13.1.el8_7 +19
  • RHSA-2023:0839 Released 2023-02-21 · Red Hat rating Important
    kpatch-patch security update
    • Red Hat Enterprise Linux BaseOS (v. 8) kpatch-patch-4_18_0-425_10_1-1-1.el8_7, kpatch-patch-4_18_0-425_3_1-1-3.el8
  • RHSA-2023:0854 Released 2023-02-21 · Red Hat rating Important
    kernel-rt security and bug fix update
    • Red Hat Enterprise Linux Real Time for NFV (v. 8) kernel-rt-4.18.0-425.13.1.rt7.223.el8_7, kernel-rt-core-4.18.0-425.13.1.rt7.223.el8_7, kernel-rt-debug-4.18.0-425.13.1.rt7.223.el8_7 +9
    • Red Hat Enterprise Linux for Real Time (v. 8) kernel-rt-4.18.0-425.13.1.rt7.223.el8_7, kernel-rt-core-4.18.0-425.13.1.rt7.223.el8_7, kernel-rt-debug-4.18.0-425.13.1.rt7.223.el8_7 +7
Show 6 more Red Hat advisories
  • RHSA-2023:0348 Released 2023-01-23 · Red Hat rating Important
    kpatch-patch security update
    • Red Hat Enterprise Linux BaseOS (v. 9) kpatch-patch-5_14_0-162_6_1-1-1.el9_1
  • RHSA-2023:0300 Released 2023-01-23 · Red Hat rating Important
    kernel-rt security and bug fix update
    • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt-5.14.0-162.12.1.rt21.175.el9_1, kernel-rt-core-5.14.0-162.12.1.rt21.175.el9_1, kernel-rt-debug-5.14.0-162.12.1.rt21.175.el9_1 +7
    • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt-5.14.0-162.12.1.rt21.175.el9_1, kernel-rt-core-5.14.0-162.12.1.rt21.175.el9_1, kernel-rt-debug-5.14.0-162.12.1.rt21.175.el9_1 +9
  • RHSA-2023:0334 Released 2023-01-23 · Red Hat rating Important
    kernel security and bug fix update
    • Red Hat CodeReady Linux Builder (v. 9) kernel-tools-libs-devel-5.14.0-162.12.1.el9_1
    • Red Hat Enterprise Linux AppStream (v. 9) kernel-debug-devel-5.14.0-162.12.1.el9_1, kernel-debug-devel-matched-5.14.0-162.12.1.el9_1, kernel-devel-5.14.0-162.12.1.el9_1 +5
    • Red Hat Enterprise Linux BaseOS (v. 9) bpftool-5.14.0-162.12.1.el9_1, kernel-5.14.0-162.12.1.el9_1, kernel-abi-stablelists-5.14.0-162.12.1.el9_1 +14
  • RHSA-2022:9082 Released 2022-12-15 · Red Hat rating Important
    kpatch-patch security update
    • Red Hat Enterprise Linux BaseOS EUS (v.9.0) kpatch-patch-5_14_0-70_13_1-1-5.el9_0, kpatch-patch-5_14_0-70_17_1-1-4.el9_0, kpatch-patch-5_14_0-70_22_1-1-4.el9_0 +2
  • RHSA-2022:8973 Released 2022-12-13 · Red Hat rating Important
    kernel security and bug fix update
    • Red Hat CodeReady Linux Builder EUS (v.9.0) kernel-tools-libs-devel-5.14.0-70.36.1.el9_0
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) kernel-debug-devel-5.14.0-70.36.1.el9_0, kernel-debug-devel-matched-5.14.0-70.36.1.el9_0, kernel-devel-5.14.0-70.36.1.el9_0 +5
    • Red Hat Enterprise Linux BaseOS EUS (v.9.0) bpftool-5.14.0-70.36.1.el9_0, kernel-5.14.0-70.36.1.el9_0, kernel-abi-stablelists-5.14.0-70.36.1.el9_0 +14
  • RHSA-2022:8974 Released 2022-12-13 · Red Hat rating Important
    kernel-rt security and bug fix update
    • Red Hat Enterprise Linux Real Time EUS (v.9.0) kernel-rt-5.14.0-70.36.1.rt21.108.el9_0, kernel-rt-core-5.14.0-70.36.1.rt21.108.el9_0, kernel-rt-debug-5.14.0-70.36.1.rt21.108.el9_0 +7
    • Red Hat Enterprise Linux Real Time for NFV EUS (v.9.0) kernel-rt-5.14.0-70.36.1.rt21.108.el9_0, kernel-rt-core-5.14.0-70.36.1.rt21.108.el9_0, kernel-rt-debug-5.14.0-70.36.1.rt21.108.el9_0 +9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat CodeReady Linux Builder (v. 8)Fixed RHSA-2023:0832
Red Hat CodeReady Linux Builder (v. 9)Fixed RHSA-2023:0334
Red Hat CodeReady Linux Builder EUS (v.9.0)Fixed RHSA-2022:8973
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:0334
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2022:8973
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2023:0832, RHSA-2023:0839
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2023:0334, RHSA-2023:0348
Red Hat Enterprise Linux BaseOS EUS (v.9.0)Fixed RHSA-2022:8973, RHSA-2022:9082
Red Hat Enterprise Linux Real Time (v. 9)Fixed RHSA-2023:0300
Red Hat Enterprise Linux Real Time EUS (v.9.0)Fixed RHSA-2022:8974
Red Hat Enterprise Linux Real Time for NFV (v. 8)Fixed RHSA-2023:0854
Red Hat Enterprise Linux Real Time for NFV (v. 9)Fixed RHSA-2023:0300
Red Hat Enterprise Linux Real Time for NFV EUS (v.9.0)Fixed RHSA-2022:8974
Red Hat Enterprise Linux for Real Time (v. 8)Fixed RHSA-2023:0854
Not affected: 1 product
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-43945
  2. 2026-10-03 Alias added: GHSA-42x7-fjc5-38vr
  3. 2026-11-01 EPSS moved to the 90th–95th percentile

References

Patch 1

Advisory 1

Other 1

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
  • TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
See all 15278 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences