VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Jul 16, 2024· Updated May 12, 2026

CVE-2022-48828

CVE-2022-48828

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Fix ia_size underflow

iattr::ia_size is a loff_t, which is a signed 64-bit type. NFSv3 and NFSv4 both define file size as an unsigned 64-bit type. Thus there is a range of valid file size values an NFS client can send that is already larger than Linux can handle.

Currently decode_fattr4() dumps a full u64 value into ia_size. If that value happens to be larger than S64_MAX, then ia_size underflows. I'm about to fix up the NFSv3 behavior as well, so let's catch the underflow in the common code path: nfsd_setattr().

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

NFSD in the Linux kernel improperly validates file sizes from NFS clients, causing a signed integer underflow in ia_size that can lead to unexpected behavior.

Vulnerability

Overview

NFSD in the Linux kernel mishandles file size values provided by NFS clients. The internal iattr::ia_size field is a signed 64-bit type (loff_t), but NFSv3 and NFSv4 define file sizes as unsigned 64-bit values. When a client sends a file size larger than S64_MAX, decoding functions such as decode_fattr4() directly assign the full u64 value into ia_size, resulting in an integer underflow.

Exploitation

Scenario

An authenticated NFS client can send a crafted file size during SETATTR or WRITE operations. No special network position is required beyond standard NFS access. The vulnerability can be triggered remotely by an attacker with the ability to mount and perform operations on the NFS share.

Impact

A successful exploit causes ia_size to wrap to a negative value, leading to incorrect size calculations, potential denial of service, or other undefined behavior in the kernel. The exact impact may vary depending on subsequent operations, but the underflow can corrupt file metadata or cause system instability.

Mitigation

The fix introduces bounds checking in the common nfsd_setattr() path to reject file sizes that exceed the maximum signed 64-bit value. Patches have been included in the Linux kernel stable tree as commits [3] and [4]. Administrators should update to a kernel version containing these patches to remediate the issue.

References
  1. Making sure you're not a bot!
  2. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

123

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.